Function at 0x40ce60
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x9c
mov eax, dword [0x47e080]
xor eax, ebp
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x1c]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.0041ca10
lea eax, str.ntdll.dll
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub esp, 4
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x60]
mov edx, dword [ebp - 0x5c]
lea eax, [ebp - 0x1c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
sub esp, 0x10
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x64], eax
lea eax, str.c:windows_system32_ntdll.dll
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
sub esp, 0x18
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
sub esp, 0x14
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x88], 0x7c0191fd
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x8c], eax
sub eax, 0x8dd1e78c
je 0x40d563
jmp 0x40cfbe
mov eax, dword [ebp - 0x8c]
sub eax, 0x91ba8640
je 0x40d4f4
jmp 0x40cfd4
mov eax, dword [ebp - 0x8c]
sub eax, 0x927cc77d
je 0x40d2a3
jmp 0x40cfea
mov eax, dword [ebp - 0x8c]
sub eax, 0xac3ffa29
je 0x40d301
jmp 0x40d000
mov eax, dword [ebp - 0x8c]
sub eax, 0xaf7b59aa
je 0x40d1ea
jmp 0x40d016
mov eax, dword [ebp - 0x8c]
sub eax, 0xb2901c4d
je 0x40d663
jmp 0x40d02c
mov eax, dword [ebp - 0x8c]
sub eax, 0xb59857eb
je 0x40d5ee
jmp 0x40d042
mov eax, dword [ebp - 0x8c]
sub eax, 0xc191a80c
je 0x40d675
jmp 0x40d058
mov eax, dword [ebp - 0x8c]
sub eax, 0xc3f22e8e
je 0x40d23f
jmp 0x40d06e
mov eax, dword [ebp - 0x8c]
sub eax, 0xcb7c8bae
je 0x40d471
jmp 0x40d084
mov eax, dword [ebp - 0x8c]
sub eax, 0xcd2072ee
je 0x40d621
jmp 0x40d09a
mov eax, dword [ebp - 0x8c]
sub eax, 0xd558d691
je 0x40d3cd
jmp 0x40d0b0
mov eax, dword [ebp - 0x8c]
sub eax, 0xde9ad97c
je 0x40d64e
jmp 0x40d0c6
mov eax, dword [ebp - 0x8c]
sub eax, 0xdea90bdc
je 0x40d480
jmp 0x40d0dc
mov eax, dword [ebp - 0x8c]
sub eax, 0xdfec5677
je 0x40d5c8
jmp 0x40d0f2
mov eax, dword [ebp - 0x8c]
sub eax, 0xf7023b85
je 0x40d226
jmp 0x40d108
mov eax, dword [ebp - 0x8c]
sub eax, 0x41b479c
je 0x40d51a
jmp 0x40d11e
mov eax, dword [ebp - 0x8c]
sub eax, 0x2618444c
je 0x40d274
jmp 0x40d134
mov eax, dword [ebp - 0x8c]
sub eax, 0x37f50d72
je 0x40d25f
jmp 0x40d14a
mov eax, dword [ebp - 0x8c]
sub eax, 0x55c66e43
je 0x40d205
jmp 0x40d160
mov eax, dword [ebp - 0x8c]
sub eax, 0x71a9d343
je 0x40d35f
jmp 0x40d176
mov eax, dword [ebp - 0x8c]
sub eax, 0x7212fded
je 0x40d503
jmp 0x40d18c
mov eax, dword [ebp - 0x8c]
sub eax, 0x78dfd8f7
je 0x40d5d7
jmp 0x40d1a2
mov eax, dword [ebp - 0x8c]
sub eax, 0x7c0191fd
je 0x40d1bd
jmp 0x40d1b8
jmp 0x40d687
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x74]
mov ecx, dword [ecx + 0x3c]
sub eax, 0x77c04558
add eax, ecx
add eax, 0x77c04558
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x88], 0xaf7b59aa
jmp 0x40d687
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x78], eax
mov word [ebp - 0x7a], 0
mov dword [ebp - 0x88], 0x55c66e43
jmp 0x40d687
movzx eax, word [ebp - 0x7a]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x78]
mov ax, word [eax + 6]
mov word [ebp - 0x4a], ax
mov dword [ebp - 0x88], 0xf7023b85
jmp 0x40d687
mov ax, word [ebp - 0x4a]
movzx eax, ax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x88], 0xc3f22e8e
jmp 0x40d687
mov edx, dword [ebp - 0x50]
mov esi, dword [ebp - 0x48]
mov eax, 0xb59857eb
mov ecx, 0x37f50d72
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x40d687
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x88], 0x2618444c
jmp 0x40d687
mov eax, dword [ebp - 0x44]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x18
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x78]
mov ax, word [eax + 0x14]
mov word [ebp - 0x3a], ax
mov dword [ebp - 0x88], 0x927cc77d
jmp 0x40d687
mov ax, word [ebp - 0x3a]
movzx ecx, ax
mov eax, dword [ebp - 0x40]
add eax, 0xadc6e5cd
add eax, ecx
sub eax, 0xadc6e5cd
movzx ecx, word [ebp - 0x7a]
imul edx, ecx, 0x28
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x80], eax
mov ecx, dword [ebp - 0x80]
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x42bd3d
call fcn.00420310
mov edx, eax
mov eax, 0xac3ffa29
mov ecx, 0x91ba8640
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x40d687
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x80]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub edx, eax
lea eax, [ebp - 0x20]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x81], al
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x88], 0x71a9d343
jmp 0x40d687
mov ecx, dword [0x47f55c]
mov eax, dword [0x47f558]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb2901c4d
mov ecx, 0xd558d691
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x40d687
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x80]
mov ecx, dword [ecx + 0xc]
add eax, 0x3e2c32bd
add eax, ecx
sub eax, 0x3e2c32bd
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x80]
mov ecx, dword [ecx + 0xc]
add eax, 0x483e7e3c
add eax, ecx
sub eax, 0x483e7e3c
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x2c], eax
mov ecx, dword [0x47f55c]
mov eax, dword [0x47f558]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb2901c4d
mov ecx, 0xcb7c8bae
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x40d687
mov dword [ebp - 0x88], 0xdea90bdc
jmp 0x40d687
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0041cb70
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x80]
mov edx, dword [eax + 8]
mov esi, dword [ebp - 0x64]
mov eax, dword [ebp - 0x80]
mov edi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
xor esi, esi
sub esi, edi
add eax, esi
xor esi, esi
sub esi, eax
lea eax, [ebp - 0x20]
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x81], al
mov dword [ebp - 0x88], 0x91ba8640
jmp 0x40d687
mov dword [ebp - 0x88], 0x7212fded
jmp 0x40d687
mov ax, word [ebp - 0x7a]
mov word [ebp - 0x28], ax
mov dword [ebp - 0x88], 0x41b479c
jmp 0x40d687
mov eax, dword [0x47f55c]
mov ecx, dword [0x47f558]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc191a80c
mov ecx, 0x8dd1e78c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x40d687
mov ax, word [ebp - 0x28]
sub ax, 0xf6ed
add ax, 1
add ax, 0xf6ed
mov word [ebp - 0x26], ax
mov eax, dword [0x47f55c]
mov ecx, dword [0x47f558]
mov edx, eax
sub edx, 0xb9c7fff0
sub edx, 1
add edx, 0xb9c7fff0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc191a80c
mov ecx, 0xdfec5677
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x88], eax
jmp 0x40d687
mov dword [ebp - 0x88], 0x78dfd8f7
jmp 0x40d687
mov ax, word [ebp - 0x26]
mov word [ebp - 0x7a], ax
mov dword [ebp - 0x88], 0x55c66e43
jmp 0x40d687
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x68]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x88], 0xcd2072ee
jmp 0x40d687
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esp, 4
mov dword [ebp - 0x88], 0xde9ad97c
jmp 0x40d687
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041bd00
add esp, 0x9c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x88], 0xd558d691
jmp 0x40d687
mov ax, word [ebp - 0x28]
mov ax, word [ebp - 0x28]
mov dword [ebp - 0x88], 0x8dd1e78c
jmp 0x40cfa2