Function at 0x40af06
Capabilities:
Read file via mapping

Disassembly:
push 0x8c
mov eax, 0x457b7a
call fcn.00456afc
mov eax, ecx
mov dword [ebp - 0x7c], eax
xor ebx, ebx
test eax, eax
jne 0x40af27
mov al, 1
jmp 0x40b1ed
lea ecx, [ebp - 0x71]
mov edx, eax
push ecx
lea ecx, [ebp - 0x40]
call fcn.0040aca4
pop ecx
lea edx, [ebp - 0x40]
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x58]
call fcn.00408986
lea ecx, [ebp - 0x58]
call fcn.00404106
cmp dword [ebp - 0x30], 0
je 0x40b1e1
cmp dword [ebp - 0x2c], 7
lea esi, [ebp - 0x40]
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
cmova esi, dword [ebp - 0x40]
push str.web_vksaver_install.exe
push esi
call edi
pop ecx
pop ecx
test eax, eax
jne 0x40b0d0
push str.GlobalVKSaverSharedMem
push 0x20
push ebx
push 4
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x90], esi
mov dword [ebp - 0x8c], edi
mov byte [ebp - 4], 1
test edi, edi
je 0x40b061
push ebx
push ebx
push ebx
push 6
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], esi
mov byte [ebp - 4], 2
test esi, esi
je 0x40b04c
cmp byte [esi], 0x2a
jne 0x40b04c
xor eax, eax
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
lea ecx, [esi + 1]
push 0x20
push ecx
lea ecx, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.00404ae8
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.0040bb8b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xf
jbe 0x40b044
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40b03b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40b03b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00455501
pop ecx
pop ecx
mov eax, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edi, dword [ebp - 0x78]
mov byte [ebp - 4], 4
test esi, esi
je 0x40b057
push esi
call eax
mov byte [ebp - 4], 1
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x7c]
lea ecx, [ebp - 0x58]
call fcn.00408d84
lea edx, [ebp - 0x58]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x70]
call fcn.0040ae54
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.00409a42
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x80]
call fcn.00409a8f
mov ecx, dword [0x679680]
test al, al
cmovne ecx, dword [ebp - 0x80]
cmp ecx, dword [0x679680]
lea ecx, [ebp - 0x70]
setne bl
call fcn.00404106
lea ecx, [ebp - 0x58]
call fcn.004044f6
mov byte [ebp - 4], 7
test edi, edi
je 0x40b1e3
push edi
call esi
jmp 0x40b1e3
push 0xe
push str.vksaver_install
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x40b1e1
push str.vksaver.exe
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x40b1e1
push str.vktray.exe
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x40b1e1
push str.explorer.exe
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x40b1e1
push str.iexplore.exe
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x40b1e1
push str.msedge.exe
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x40b1e1
push str.firefox.exe
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x40b1e1
push str.opera.exe
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x40b1e1
push str.chrome.exe
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x40b1e1
push str.safari.exe
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x40b1e1
push str.browser.exe
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x40b1e1
push str.far.exe
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x40b1e1
push str.totalcmd.exe
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x40b1e1
push str.totalcmd64.exe
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x40b1e1
push str.cmd64.exe
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x40b1e1
push str.cmd.exe
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x40b1e1
push str.runtimebroker.exe
push esi
call edi
pop ecx
pop ecx
test eax, eax
jne 0x40b1e3
mov bl, 1
lea ecx, [ebp - 0x40]
call fcn.004044f6
mov al, bl
call fcn.00456aba
ret