Function at 0x40af10
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421cf8
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x42c00c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, ecx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x50], eax
xor edi, edi
mov eax, 0x490
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x74], eax
xor eax, eax
mov dword [ebp - 0x5c], eax
xor al, al
mov byte [ebp - 0x3d], al
mov byte [ebp - 0x3e], al
xor eax, eax
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x78], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor ecx, ecx
movzx eax, ax
mov dword [ebp - 0x4c], ecx
cmp dword [ebp - 0x44], ecx
jne 0x40af8f
mov dword [ebp - 0x64], 0x57
xor edi, edi
jmp 0x40b8ae
mov ecx, 0x105
cmp ax, cx
je 0x40b069
push str.GetSystemFirmwareTable
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x40af88
push 0
push 0
push 0
push 0x52534d42
mov ecx, esi
call dword [0x422280]
call esi
mov edi, eax
test edi, edi
je 0x40af88
xor ecx, ecx
add eax, 0x400
setb cl
neg ecx
or ecx, eax
push ecx
call fcn.0041630b
mov ecx, eax
add esp, 4
mov dword [ebp - 0x68], ecx
test ecx, ecx
jne 0x40b003
mov dword [ebp - 0x64], 8
mov edi, eax
jmp 0x40b8ae
lea eax, [edi + 0x400]
push eax
push 0
push ecx
call fcn.00411430
add esp, 0xc
mov ecx, esi
push edi
mov edi, dword [ebp - 0x68]
push edi
push 0
push 0x52534d42
call dword [0x422280]
call esi
test eax, eax
je 0x40b8ae
mov edx, edi
mov al, byte [edx + 1]
mov cl, byte [edx + 2]
mov byte [ebp - 0x3d], al
mov byte [ebp - 0x3e], cl
cmp al, 2
jae 0x40b051
mov dword [ebp - 0x64], 0x718
jmp 0x40b8ae
mov eax, dword [edx + 4]
lea edi, [edx + 8]
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x64], 0
jmp 0x40b2c1
push str.NtOpenSection
push str.ntdll.dll
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], 0x2e002c
mov dword [ebp - 0x20], str.DevicePhysicalMemory
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x40b297
lea eax, [ebp - 0x24]
mov dword [ebp - 0x3c], 0x18
mov dword [ebp - 0x34], eax
mov ecx, esi
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x38], 0
push eax
push 4
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x30], 0x40
push eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
call dword [0x422280]
call esi
test eax, eax
js 0x40b297
push 0x10000
push 0xf0000
push 0
push 4
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov dword [ebp - 0x4c], esi
test esi, esi
je 0x40b299
xor eax, eax
nop dword [eax]
cmp dword [esi], 0x5f4d535f
je 0x40b125
add eax, 0x10
add esi, 0x10
cmp eax, 0x10000
jb 0x40b110
mov ecx, dword [ebp - 0x4c]
mov eax, esi
sub eax, ecx
cmp eax, 0x10000
je 0x40b293
mov al, byte [esi + 5]
cmp al, 0x1f
ja 0x40b293
cmp al, 0x1e
je 0x40b14e
cmp al, 0x1f
jne 0x40b293
movzx eax, al
sub eax, ecx
add eax, esi
cmp eax, 0x10000
ja 0x40b293
movzx eax, word [esi + 0x16]
test ax, ax
je 0x40b293
mov ecx, 0x494d445f
cmp ecx, dword [esi + 0x10]
jne 0x40b28e
mov ecx, 0x5f
cmp cl, byte [esi + 0x14]
jne 0x40b28e
mov cl, byte [esi + 6]
mov dl, byte [esi + 7]
mov byte [ebp - 0x3d], cl
mov byte [ebp - 0x3e], dl
cmp cl, 2
jb 0x40b28e
push dword [ebp - 0x4c]
mov esi, dword [esi + 0x18]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, esi
lea eax, [edi + 0xfff]
and ecx, 0xfff
add eax, ecx
mov dword [ebp - 0x74], ecx
and eax, 0xfffff000
sub esi, ecx
push eax
push esi
push 0
push 4
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov dword [ebp - 0x4c], esi
test esi, esi
je 0x40b28a
xor ecx, ecx
mov eax, edi
add eax, 0x400
setb cl
neg ecx
or ecx, eax
push ecx
call fcn.0041630b
mov edx, eax
add esp, 4
mov dword [ebp - 0x78], edx
test edx, edx
jne 0x40b213
mov ecx, 8
xor edi, edi
mov dword [ebp - 0x64], ecx
jmp 0x40b29e
lea eax, [edi + 0x400]
push eax
push 0
push edx
call fcn.00411430
mov eax, dword [ebp - 0x74]
push edi
add eax, esi
push eax
push dword [ebp - 0x78]
call fcn.004130f0
mov eax, dword [ebp - 0x78]
add esp, 0x18
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x5c], edi
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edi, dword [ebp - 0x70]
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x64], ecx
jmp 0x40b29e
xor edi, edi
jmp 0x40b299
mov esi, dword [ebp - 0x4c]
jmp 0x40b299
mov esi, ecx
jmp 0x40b299
xor esi, esi
mov ecx, 0x490
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40b2b6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x64]
test ecx, ecx
jne 0x40b8a0
mov eax, dword [ebp - 0x5c]
push 1
lea ecx, [ebp - 0x50]
mov edx, eax
push ecx
push 1
mov ecx, edi
call fcn.0040ae30
add esp, 0xc
test eax, eax
jne 0x40b30c
mov esi, dword [ebp - 0x50]
mov ecx, esi
mov eax, dword [ebp - 0x44]
add eax, 4
push eax
mov dl, byte [esi + 7]
call fcn.0040abd0
mov al, byte [ebp - 0x3d]
add esp, 4
cmp al, 2
ja 0x40b2ff
jne 0x40b30c
cmp byte [ebp - 0x3e], 1
jb 0x40b30c
movups xmm0, xmmword [esi + 8]
mov esi, dword [ebp - 0x44]
movups xmmword [esi + 8], xmm0
jmp 0x40b30f
mov esi, dword [ebp - 0x44]
mov edx, dword [ebp - 0x5c]
lea eax, [ebp - 0x50]
push 1
push eax
push 2
mov ecx, edi
call fcn.0040ae30
add esp, 0xc
test eax, eax
jne 0x40b34d
lea eax, [esi + 0x18]
mov esi, dword [ebp - 0x50]
push eax
mov ecx, esi
mov dl, byte [esi + 7]
call fcn.0040abd0
mov eax, dword [ebp - 0x44]
mov ecx, esi
mov dl, byte [esi + 8]
add eax, 0x1c
push eax
call fcn.0040abd0
add esp, 8
mov edx, dword [ebp - 0x5c]
lea eax, [ebp - 0x50]
push 1
push eax
push 3
mov ecx, edi
call fcn.0040ae30
add esp, 0xc
test eax, eax
jne 0x40b38e
mov esi, dword [ebp - 0x50]
mov ecx, esi
mov eax, dword [ebp - 0x44]
add eax, 0x20
push eax
mov dl, byte [esi + 7]
call fcn.0040abd0
mov eax, dword [ebp - 0x44]
mov ecx, esi
mov dl, byte [esi + 8]
add eax, 0x24
push eax
call fcn.0040abd0
add esp, 8
mov edx, dword [ebp - 0x5c]
lea eax, [ebp - 0x50]
push 1
push eax
push 4
mov ecx, edi
call fcn.0040ae30
add esp, 0xc
test eax, eax
jne 0x40b3e7
mov esi, dword [ebp - 0x50]
mov edi, dword [ebp - 0x44]
mov eax, dword [esi + 8]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0x2c], eax
mov al, byte [ebp - 0x3d]
cmp al, 2
ja 0x40b3c8
jne 0x40b3e7
cmp byte [ebp - 0x3e], 3
jb 0x40b3e7
mov dl, byte [esi + 0x20]
lea eax, [edi + 0x30]
push eax
mov ecx, esi
call fcn.0040abd0
mov dl, byte [esi + 0x21]
lea eax, [edi + 0x34]
push eax
mov ecx, esi
call fcn.0040abd0
add esp, 8
mov byte [ebp - 0x45], 1
nop dword [eax + eax]
mov dword [ebp - 4], 2
call fcn.00407ce0
mov edi, eax
test edi, edi
je 0x40b8ec
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x422280]
mov ecx, edi
call esi
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
mov eax, dword [ebp - 0x70]
mov cl, 1
mov dword [ebp - 4], 3
test eax, eax
je 0x40b46f
mov edx, dword [ebp - 0x5c]
test edx, edx
je 0x40b46f
add edx, eax
mov edi, eax
add eax, 4
cmp eax, edx
ja 0x40b46f
mov ch, byte [ebp - 0x45]
cmp byte [edi], 0x11
jne 0x40b451
cmp ch, cl
je 0x40b509
inc cl
movzx eax, byte [edi + 1]
add eax, edi
cmp byte [eax], 0
jne 0x40b462
cmp byte [eax + 1], 0
je 0x40b465
inc eax
jmp 0x40b457
lea edi, [eax + 2]
add eax, 6
cmp eax, edx
jbe 0x40b442
lea ecx, [esi - 0x10]
mov dword [ebp - 4], 4
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x40b49a
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x422280]
mov ecx, edi
call esi
mov dword [ebp - 4], 0xffffffff
mov dh, byte [ebp - 0x3d]
cmp dh, 2
ja 0x40b4ba
jne 0x40b815
mov al, byte [ebp - 0x3e]
cmp al, 1
jb 0x40b820
mov eax, dword [ebp - 0x70]
mov dl, 1
test eax, eax
je 0x40b812
mov esi, dword [ebp - 0x5c]
test esi, esi
je 0x40b812
add esi, eax
mov ecx, eax
add eax, 4
cmp eax, esi
ja 0x40b812
cmp byte [ecx], 0x16
jne 0x40b4f1
cmp dl, 1
je 0x40b7fd
inc dl
movzx eax, byte [ecx + 1]
add eax, ecx
cmp byte [eax], 0
jne 0x40b506
cmp byte [eax + 1], 0
je 0x40b7ed
inc eax
jmp 0x40b4f7
mov al, byte [ebp - 0x3d]
cmp al, 2
ja 0x40b520
jne 0x40b7ac
cmp byte [ebp - 0x3e], 3
jb 0x40b7ac
mov dl, byte [edi + 0x1a]
lea eax, [ebp - 0x18]
push eax
mov ecx, edi
call fcn.0040abd0
add esp, 4
test eax, eax
jne 0x40b5fc
mov eax, dword [ebp - 0x44]
mov esi, dword [ebp - 0x18]
mov edx, esi
mov eax, dword [eax + 0x38]
sub edx, eax
mov ecx, dword [esi - 0xc]
mov dword [ebp - 0x60], edx
mov edx, dword [eax - 0xc]
mov dword [ebp - 0x54], edx
test ecx, ecx
js 0x40b8f6
test esi, esi
jne 0x40b562
xor ecx, ecx
jmp 0x40b571
push ecx
push esi
call fcn.0041422d
mov edx, dword [ebp - 0x54]
add esp, 8
mov ecx, eax
mov eax, 0x7fffffff
mov dword [ebp - 0x58], ecx
sub eax, ecx
cmp eax, edx
jl 0x40b8f6
add edx, ecx
mov dword [ebp - 0x7c], edx
js 0x40b8f6
mov eax, dword [ebp - 0x44]
mov ecx, 1
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x50], eax
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edx
or eax, ecx
jge 0x40b5bc
mov ecx, dword [ebp - 0x44]
push edx
lea ecx, [ecx + 0x38]
call fcn.0040bd10
mov edx, dword [ebp - 0x44]
mov ecx, dword [edx + 0x38]
jmp 0x40b5bf
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x60]
mov esi, dword [ebp - 0x60]
add eax, ecx
cmp esi, dword [ebp - 0x54]
mov edx, dword [ebp - 0x58]
cmova eax, dword [ebp - 0x18]
add ecx, dword [ebp - 0x54]
push edx
push eax
call fcn.00407a60
mov esi, dword [ebp - 0x44]
add esp, 8
mov ecx, dword [ebp - 0x7c]
mov edx, dword [esi + 0x38]
cmp ecx, dword [edx - 8]
jg 0x40b8f6
mov dword [edx - 0xc], ecx
mov eax, dword [esi + 0x38]
mov byte [ecx + eax], 0
jmp 0x40b5ff
mov esi, dword [ebp - 0x44]
mov dl, byte [edi + 0x18]
lea eax, [ebp - 0x18]
push eax
mov ecx, edi
call fcn.0040abd0
add esp, 4
test eax, eax
jne 0x40b6d8
lea eax, [esi + 0x3c]
mov esi, dword [ebp - 0x18]
mov eax, dword [eax]
mov edx, esi
sub edx, eax
mov dword [ebp - 0x58], edx
mov ecx, dword [esi - 0xc]
mov edx, dword [eax - 0xc]
mov dword [ebp - 0x54], edx
test ecx, ecx
js 0x40b8f6
test esi, esi
jne 0x40b640
xor ecx, ecx
jmp 0x40b64f
push ecx
push esi
call fcn.0041422d
mov edx, dword [ebp - 0x54]
add esp, 8
mov ecx, eax
mov eax, 0x7fffffff
mov dword [ebp - 0x60], ecx
sub eax, ecx
cmp eax, edx
jl 0x40b8f6
add edx, ecx
mov dword [ebp - 0x7c], edx
js 0x40b8f6
mov eax, dword [ebp - 0x44]
mov ecx, 1
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x50], eax
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edx
or eax, ecx
jge 0x40b69a
mov ecx, dword [ebp - 0x44]
push edx
lea ecx, [ecx + 0x3c]
call fcn.0040bd10
mov edx, dword [ebp - 0x44]
mov ecx, dword [edx + 0x3c]
jmp 0x40b69d
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x58]
mov esi, dword [ebp - 0x58]
add eax, ecx
cmp esi, dword [ebp - 0x54]
mov edx, dword [ebp - 0x60]
cmova eax, dword [ebp - 0x18]
add ecx, dword [ebp - 0x54]
push edx
push eax
call fcn.00407a60
mov esi, dword [ebp - 0x44]
add esp, 8
mov ecx, dword [ebp - 0x7c]
mov edx, dword [esi + 0x3c]
cmp ecx, dword [edx - 8]
jg 0x40b8f6
mov dword [edx - 0xc], ecx
mov eax, dword [esi + 0x3c]
mov byte [ecx + eax], 0
mov dl, byte [edi + 0x19]
lea eax, [ebp - 0x18]
push eax
mov ecx, edi
call fcn.0040abd0
add esp, 4
test eax, eax
jne 0x40b7a9
mov eax, dword [esi + 0x40]
lea ecx, [esi + 0x40]
mov esi, dword [ebp - 0x18]
mov edi, esi
sub edi, eax
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x60], edi
mov edi, dword [eax - 0xc]
mov edx, dword [esi - 0xc]
mov dword [ebp - 0x74], edi
test edx, edx
js 0x40b8f6
test esi, esi
jne 0x40b71d
xor edx, edx
jmp 0x40b72c
push edx
push esi
call fcn.0041422d
mov ecx, dword [ebp - 0x54]
add esp, 8
mov edx, eax
mov eax, 0x7fffffff
mov dword [ebp - 0x58], edx
sub eax, edx
cmp eax, edi
jl 0x40b8f6
add edi, edx
js 0x40b8f6
mov eax, dword [ecx]
mov ecx, 1
mov dword [ebp - 0x50], eax
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or eax, ecx
jge 0x40b76f
mov ecx, dword [ebp - 0x54]
push edi
call fcn.0040bd10
mov eax, dword [ebp - 0x54]
mov edx, dword [ebp - 0x58]
mov ecx, dword [eax]
jmp 0x40b772
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x60]
push edx
mov edx, dword [ebp - 0x60]
add eax, ecx
cmp edx, dword [ebp - 0x74]
mov edx, dword [ebp - 0x58]
cmova eax, esi
add ecx, dword [ebp - 0x74]
push eax
call fcn.00407a60
mov eax, dword [ebp - 0x54]
add esp, 8
mov ecx, dword [eax]
cmp edi, dword [ecx - 8]
jg 0x40b8f6
mov dword [ecx - 0xc], edi
mov eax, dword [eax]
mov byte [edi + eax], 0
jmp 0x40b7ac
mov esi, dword [ebp - 0x18]
lea ecx, [esi - 0x10]
mov dword [ebp - 4], 5
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x40b7d7
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x422280]
mov ecx, edi
call esi
add byte [ebp - 0x45], 1
mov dword [ebp - 4], 0xffffffff
jne 0x40b3f0
jmp 0x40b4a1
lea ecx, [eax + 2]
lea eax, [ecx + 4]
cmp eax, esi
jbe 0x40b4e1
jmp 0x40b812
mov eax, dword [ebp - 0x44]
mov dl, byte [ecx + 7]
add eax, 0x44
push eax
call fcn.0040abd0
mov dh, byte [ebp - 0x3d]
add esp, 4
cmp dh, 2
ja 0x40b824
jne 0x40b89d
mov al, byte [ebp - 0x3e]
cmp al, 3
jb 0x40b89d
mov esi, dword [ebp - 0x70]
mov cl, 1
test esi, esi
je 0x40b89d
mov eax, dword [ebp - 0x5c]
test eax, eax
je 0x40b89d
lea edx, [eax + esi]
lea eax, [esi + 4]
cmp eax, edx
ja 0x40b89d
nop
cmp byte [esi], 0x27
jne 0x40b84d
cmp cl, 1
je 0x40b86d
add cl, 1
movzx eax, byte [esi + 1]
add eax, esi
cmp byte [eax], 0
jne 0x40b85e
cmp byte [eax + 1], 0
je 0x40b861
inc eax
jmp 0x40b853
lea esi, [eax + 2]
lea eax, [esi + 4]
cmp eax, edx
jbe 0x40b840
jmp 0x40b89d
mov edi, dword [ebp - 0x44]
mov ecx, esi
mov dl, byte [esi + 0xa]
lea eax, [edi + 0x48]
push eax
call fcn.0040abd0
mov dl, byte [esi + 8]
lea eax, [edi + 0x4c]
push eax
mov ecx, esi
call fcn.0040abd0
mov dl, byte [esi + 9]
lea eax, [edi + 0x50]
push eax
mov ecx, esi
call fcn.0040abd0
add esp, 0xc
mov esi, dword [ebp - 0x4c]
test esi, esi
je 0x40b8ab
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edi, dword [ebp - 0x68]
push 0
call fcn.004162f0
push edi
call fcn.004162f0
push dword [ebp - 0x78]
call fcn.004162f0
mov eax, dword [ebp - 0x44]
add esp, 0xc
mov ecx, dword [ebp - 0x64]
mov dword [eax], ecx
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040fb5d
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00407b20
push 0x80070057
call fcn.00407b20
int3