Function at 0x40e8a0
Capabilities:
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xf8
mov eax, dword [0x438014]
xor eax, ebp
mov dword [esp + 0xf0], eax
cmp byte [ecx + 0x14], 0
je 0x40f4a3
mov esi, edx
mov dword [esp + 0xc], ecx
test byte [ecx + 0x10], 4
jne 0x40e8fe
mov edx, esi
mov edi, edx
movzx eax, byte [edx]
cmp eax, 0xff
je 0x40f3df
mov edx, edi
cmp eax, 0xeb
je 0x40f3f5
cmp edi, edx
jne 0x40e8d5
cmp edi, esi
jne 0x40f5a5
mov eax, dword [esp + 0xc]
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], esi
mov dword [esp + 0x70], 0
mov eax, dword [0x439384]
mov ecx, dword [0x4380f8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jle 0x40e968
push 0x439384
call fcn.0041700a
add esp, 4
cmp dword [0x439384], 0xffffffff
jne 0x40e968
lea esi, [esp + 0x98]
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esi + 0x1c]
mov dword [0x439380], eax
push 0x439384
call fcn.00416fc0
add esp, 4
mov eax, dword [0x439380]
mov dword [esp], eax
xor edi, edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x48], edi
mov eax, dword [0x43938c]
mov ecx, dword [0x4380f8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x40ef3b
push 0x439390
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [esp + 0x48], 0
jne 0x40f4ae
mov dword [esp + 4], 0
mov esi, dword [0x43937c]
test esi, esi
jne 0x40e9e8
mov ebx, 0xc
push ebx
call dword [sym.imp.mozglue.dll_moz_xmalloc]
add esp, 4
mov esi, eax
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi], ebx
mov dword [0x43937c], esi
cmp byte [esp + 0x48], 0
jne 0x40f4e5
cmp dword [esi + 4], 0
jne 0x40ea4e
push 0x14
call dword [sym.imp.mozglue.dll_moz_xmalloc]
add esp, 4
mov ebx, eax
xorps xmm0, xmm0
movups xmmword [eax + 4], xmm0
mov eax, dword [esi + 4]
cmp eax, dword [esi + 8]
jne 0x40ea1f
mov ecx, esi
call fcn.0040fcd0
mov eax, dword [esi + 4]
lea eax, [eax + eax*2]
mov ecx, dword [esi]
mov dword [ecx + eax*4 + 4], edi
mov edx, dword [esp + 4]
mov dword [ecx + eax*4], edx
mov dword [ecx + eax*4 + 8], ebx
inc dword [esi + 4]
mov esi, dword [0x43937c]
test esi, esi
je 0x40f498
cmp dword [esi + 4], 0
je 0x40f498
mov ebx, dword [esi]
mov edi, dword [ebx + 8]
test edi, edi
je 0x40f8b6
cmp dword [esp], 0
je 0x40f8b6
cmp dword [edi + 4], 0
jne 0x40ef33
mov eax, dword [0x439384]
mov ecx, dword [0x4380f8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jle 0x40eac5
push 0x439384
call fcn.0041700a
add esp, 4
cmp dword [0x439384], 0xffffffff
jne 0x40eac5
lea esi, [esp + 0x98]
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esi + 0x1c]
mov dword [0x439380], eax
push 0x439384
call fcn.00416fc0
add esp, 4
mov esi, dword [0x439380]
mov ecx, dword [esp]
mov eax, ecx
xor edx, edx
div esi
sub esi, edx
test edx, edx
cmove esi, edx
add esi, ecx
lea ebx, [edi + 8]
mov dword [edi + 8], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp byte [esp + 0x48], 0
jne 0x40f7e5
push 1
push 0x2000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x40f8a9
mov dword [edi + 4], eax
cmp dword [ebx], 0
je 0x40f8b6
push 0x439390
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x43938c]
mov ecx, dword [0x4380f8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x40ef83
push 0x439390
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 4]
test eax, eax
je 0x40f8b6
mov esi, dword [edi + 0x10]
shl esi, 7
mov edx, esi
or edx, 0x7f
mov ecx, dword [edi + 0xc]
cmp edx, ecx
jb 0x40ebe4
cmp ecx, dword [edi + 8]
jae 0x40f8b6
mov eax, dword [0x4393b8]
mov ecx, dword [0x4380f8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x40f349
mov eax, dword [edi + 4]
add eax, dword [edi + 0xc]
push 0x20
push 0x1000
push dword [0x4393b4]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x40f8b6
mov eax, dword [0x4393b8]
mov ecx, dword [0x4380f8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x40f38b
mov eax, dword [0x4393b4]
add dword [edi + 0xc], eax
mov eax, dword [edi + 4]
add esi, eax
lea eax, [esp + 0x9c]
mov dword [eax - 4], edi
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov ecx, 0x80
mov dword [eax + 0x14], ecx
mov byte [eax + 0x18], 1
push eax
push 0x40
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x40f5b6
mov ecx, dword [esp + 0x98]
mov edx, dword [esp + 0xa4]
test ecx, ecx
je 0x40f5c6
mov esi, dword [esp + 0x9c]
mov eax, dword [esp + 0xa0]
mov bl, byte [esp + 0xb4]
mov byte [esp + 4], bl
mov dword [esp], eax
test eax, eax
mov dword [esp + 0x10], esi
je 0x40ec6b
test edx, edx
je 0x40ec6b
test esi, esi
je 0x40ec6b
cmp byte [esp + 4], 0
je 0x40ec6b
inc dword [edi + 0x10]
mov dword [esp + 0x40], ecx
mov esi, dword [esp]
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], edx
mov edi, dword [esp + 0xa8]
mov dword [esp + 8], ecx
mov eax, dword [esp + 0xac]
mov dword [esp + 0x18], eax
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], eax
mov ebx, dword [esp + 0xb0]
mov dword [esp + 0x58], ebx
mov byte [esp + 0x60], 1
push 0x439390
mov dword [esp + 0x20], edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 8]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], ecx
mov dword [esp], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], edx
mov dword [esp + 0x14], edi
mov dword [esp + 0x30], edi
mov eax, dword [esp + 0x18]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x38], ebx
mov ebx, eax
mov al, byte [esp + 4]
mov byte [esp + 0x3c], al
xor esi, esi
mov dword [esp + 0x44], esi
mov byte [esp + 0x5c], 0
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
test ebx, ebx
je 0x40f5eb
cmp dword [esp], 0
mov edi, dword [esp + 0x14]
je 0x40f2ae
test edx, edx
je 0x40f2ae
test ecx, ecx
je 0x40f2ae
cmp byte [esp + 4], 0
je 0x40f2ae
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_EncodePointer]
lea ecx, [edi + 4]
cmp ecx, dword [esp + 0x18]
ja 0x40f622
mov ecx, dword [esp]
mov dword [ecx + edi], eax
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x30]
add edi, 4
mov dword [esp + 0x30], edi
mov dword [esp + 4], eax
test eax, eax
je 0x40f63a
mov al, byte [esp + 0x3c]
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
test esi, esi
je 0x40f2ae
test edx, edx
je 0x40f2ae
test ecx, ecx
je 0x40f2ae
test al, al
je 0x40f2ae
mov eax, dword [esp + 0x6c]
mov ebx, dword [esp + 0x70]
mov dword [esp], eax
add eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_EncodePointer]
lea esi, [edi + 4]
cmp dword [esp + 4], 0
je 0x40f647
cmp esi, dword [esp + 0x38]
ja 0x40f68a
mov ecx, dword [esp + 0x28]
mov dword [ecx + edi], eax
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x30]
add esi, 4
mov dword [esp + 0x30], esi
mov dword [esp + 4], eax
test eax, eax
je 0x40f64b
mov al, byte [esp + 0x3c]
cmp dword [esp + 0x28], 0
je 0x40f2a2
cmp dword [esp + 0x2c], 0
je 0x40f2a2
cmp dword [esp + 0x24], 0
je 0x40f2a2
test al, al
je 0x40f2a2
mov dword [esp + 0x34], esi
xor eax, eax
dec eax
cmp ebx, 4
ja 0x40efcb
mov dword [esp + 0xc], eax
xor eax, eax
mov edi, ebx
mov ecx, dword [esp]
movzx ecx, byte [ecx + edi]
cmp ecx, 0x65
jg 0x40ee67
lea edx, [ecx - 0x2e]
cmp edx, 0x10
ja 0x40ee5a
mov ebx, 0x10101
bt ebx, edx
jb 0x40f3cd
add ecx, 0xffffff9c
cmp ecx, 2
jae 0x40ee8d
jmp 0x40f3cd
cmp ecx, 0x66
je 0x40f47a
cmp ecx, 0x67
je 0x40f489
add ecx, 0xffffff10
cmp ecx, 3
ja 0x40ee8d
cmp ecx, 1
jne 0x40f7cf
test al, 0xc
jne 0x40f2a2
mov edx, dword [esp]
movzx eax, byte [edx + edi]
mov ecx, eax
and cl, 0xfc
cmp cl, 0x88
jne 0x40eed2
movzx eax, byte [edx + edi + 1]
mov ebx, eax
shr ebx, 6
xor edx, edx
inc edx
cmp ebx, 3
jne 0x40f43d
lea ebx, [edx + edi]
inc ebx
mov dword [esp + 0x70], ebx
cmp ebx, 5
jb 0x40ee34
jmp 0x40efcf
cmp eax, 0xa0
jg 0x40eeec
cmp eax, 0xf
je 0x40f8c8
cmp eax, 0x33
jne 0x40ef02
jmp 0x40f8f3
cmp eax, 0xa1
je 0x40f435
cmp eax, 0xb8
je 0x40f435
mov ecx, eax
and cl, 0xf8
cmp cl, 0x40
je 0x40ef2e
cmp eax, 0x68
je 0x40f435
cmp eax, 0x83
je 0x40f6e5
mov ecx, eax
and cl, 0xf0
cmp cl, 0x50
jne 0x40f6fc
inc edi
mov ebx, edi
jmp 0x40eec0
lea ebx, [edi + 8]
jmp 0x40eb0f
push 0x43938c
call fcn.0041700a
add esp, 4
cmp dword [0x43938c], 0xffffffff
jne 0x40e99f
push 0x1000000
push 0xfa0
push 0x439390
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
mov byte [0x439388], 1
push 0x43938c
call fcn.00416fc0
add esp, 4
jmp 0x40e99f
push 0x43938c
call fcn.0041700a
add esp, 4
cmp dword [0x43938c], 0xffffffff
jne 0x40eb44
push 0x1000000
push 0xfa0
push 0x439390
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
mov byte [0x439388], 1
push 0x43938c
call fcn.00416fc0
add esp, 4
jmp 0x40eb44
mov dword [esp + 0xc], eax
lea eax, [ebx + esi]
cmp dword [esp + 4], 0
je 0x40f698
cmp eax, dword [esp + 0x38]
ja 0x40f6bc
add esi, dword [esp + 0x28]
push ebx
push dword [esp + 4]
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov esi, dword [esp + 0x30]
add esi, ebx
mov dword [esp + 0x30], esi
cmp dword [esp + 0x20], 0
mov eax, esi
je 0x40f69c
mov eax, dword [esp + 0x28]
test eax, eax
je 0x40f2a2
cmp dword [esp + 0x2c], 0
je 0x40f2a2
cmp dword [esp + 0x24], 0
je 0x40f2a2
cmp byte [esp + 0x3c], 0
je 0x40f2a2
cmp ebx, 0x64
ja 0x40f2a2
mov ecx, dword [esp + 0xc]
test ecx, ecx
jns 0x40f71d
mov ecx, dword [esp + 0x38]
cmp esi, ecx
jae 0x40f73a
mov byte [eax + esi], 0xe9
mov esi, dword [esp + 0x30]
inc esi
mov dword [esp + 0x30], esi
cmp dword [esp + 0x20], 0
je 0x40f6b0
mov ecx, dword [esp + 0x38]
lea eax, [esi + 4]
cmp eax, ecx
ja 0x40f730
mov eax, dword [esp]
add eax, ebx
mov ecx, dword [esp + 0x2c]
add ecx, esi
sub eax, ecx
add eax, 0xfffffffc
mov ecx, dword [esp + 0x28]
mov dword [ecx + esi], eax
add dword [esp + 0x30], 4
cmp byte [esp + 0x3c], 0
je 0x40f2a2
cmp dword [esp + 0x20], 0
je 0x40f2a2
mov eax, dword [esp + 0x34]
add eax, dword [esp + 0x2c]
mov dword [esp + 4], eax
je 0x40f2a2
mov edx, dword [esp + 0x68]
lea ecx, [esp + 0xb8]
mov dword [ecx - 0x20], edx
mov eax, dword [esp]
mov dword [ecx - 0x1c], eax
mov dword [ecx - 0x18], ebx
xor edi, edi
mov dword [ecx - 0x14], edi
mov dword [ecx - 0x10], edi
mov dword [ecx - 8], edi
mov dword [ecx - 4], 0x10
mov dword [ecx - 0xc], ecx
mov byte [ecx + 0x10], 1
lea esi, [esp + 0xcc]
mov ecx, esi
push ebx
push eax
call fcn.0040fba0
add esp, 8
cmp dword [esi + 8], edi
je 0x40f21b
cmp byte [esp + 0xc8], 0
je 0x40f21b
lea esi, [esp + 0xac]
mov eax, dword [esi + 4]
cmp eax, dword [esi + 8]
je 0x40f762
mov ecx, dword [esp + 0xac]
mov byte [ecx + eax], 0xe9
mov ebx, dword [esp + 0xa4]
mov eax, dword [esp + 0xb0]
inc eax
mov dword [esp + 0xb0], eax
inc ebx
mov dword [esp + 0xa4], ebx
add ebx, dword [esp + 0x9c]
lea ecx, [eax + 4]
cmp ecx, dword [esp + 0xb4]
ja 0x40f780
mov ecx, dword [ebp + 8]
sub ecx, ebx
add ecx, 0xfffffffc
mov edx, dword [esp + 0xac]
mov dword [edx + eax], ecx
add dword [esp + 0xb0], 4
mov eax, dword [esp + 0xa4]
add eax, 4
mov dword [esp + 0xa4], eax
cmp eax, dword [esp + 0xa0]
jb 0x40f7a0
cmp dword [esp + 0xd4], 0
je 0x40f21b
cmp byte [esp + 0xc8], 0
je 0x40f21b
mov eax, dword [esp + 0xb0]
test eax, eax
je 0x40f212
mov ecx, dword [esp + 0xa8]
add ecx, dword [esp + 0x9c]
push eax
push dword [esp + 0xb0]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor esi, esi
push esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, dword [esp + 0xb0]
add dword [esp + 0xa8], eax
mov dword [esp + 0xb0], esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov eax, dword [0x4393b8]
mov ecx, dword [0x4380f8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x40f30a
mov esi, dword [esp + 0xd0]
mov eax, dword [esp + 0xd4]
test eax, eax
je 0x40f276
mov ebx, dword [0x4393b4]
lea edi, [esi + eax*8]
lea eax, [esp + 0x74]
push eax
push dword [esi]
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esi, 8
cmp esi, edi
jne 0x40f257
mov esi, dword [esp + 0xd0]
lea eax, [esp + 0xdc]
mov dword [eax - 8], 0
cmp esi, eax
jne 0x40f744
mov eax, dword [esp + 0xac]
lea ecx, [esp + 0xb8]
cmp eax, ecx
jne 0x40f753
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x40f658
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
setne bl
mov eax, dword [esp + 0x28]
test eax, eax
je 0x40f2d7
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x40f2d7
lea edx, [esp + 0x24]
push edx
push ecx
push dword [edx + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp byte [esp + 0x60], 0
je 0x40f2f2
mov eax, dword [esp + 0x48]
test eax, eax
je 0x40f2f2
mov ecx, dword [esp + 0x44]
test ecx, ecx
jne 0x40f60d
mov ecx, dword [esp + 0xf0]
xor ecx, ebp
call fcn.00417da0
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4393b8
call fcn.0041700a
add esp, 4
cmp dword [0x4393b8], 0xffffffff
jne 0x40f23c
lea esi, [esp + 0x74]
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esi + 4]
mov dword [0x4393b4], eax
push 0x4393b8
call fcn.00416fc0
add esp, 4
jmp 0x40f23c
push 0x4393b8
call fcn.0041700a
add esp, 4
cmp dword [0x4393b8], 0xffffffff
jne 0x40eb96
lea ebx, [esp + 0x98]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebx + 4]
mov dword [0x4393b4], eax
push 0x4393b8
call fcn.00416fc0
add esp, 4
jmp 0x40eb96
push 0x4393b8
call fcn.0041700a
add esp, 4
cmp dword [0x4393b8], 0xffffffff
jne 0x40ebd9
lea ebx, [esp + 0x98]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebx + 4]
mov dword [0x4393b4], eax
push 0x4393b8
call fcn.00416fc0
add esp, 4
jmp 0x40ebd9
mov cl, 2
test al, 2
jne 0x40f2a2
or al, cl
inc edi
jmp 0x40ee38
cmp byte [edi + 1], 0x25
mov edx, edi
jne 0x40e8f2
mov eax, dword [edi + 2]
mov edx, dword [eax]
jmp 0x40e8f2
movsx eax, byte [edi + 1]
add eax, edi
add eax, 2
mov ecx, eax
sub ecx, edi
shl ecx, 0x18
add ecx, 0xfe000000
mov edx, edi
test ecx, ecx
jle 0x40e8f2
sar ecx, 0x18
xor edx, edx
cmp byte [edx + edi + 2], 0x90
jne 0x40f7de
inc dl
movsx edx, dl
cmp ecx, edx
jg 0x40f41a
mov edx, eax
jmp 0x40e8f2
add edi, 5
jmp 0x40ef2f
test ebx, ebx
jne 0x40f6c6
mov ecx, eax
and ecx, 7
cmp ecx, 5
je 0x40f6d5
cmp ecx, 4
jne 0x40f945
mov ecx, dword [esp]
mov cl, byte [ecx + edi + 2]
and cl, 7
xor edx, edx
cmp cl, 5
sete dl
lea ecx, [edx*4 + 1]
jmp 0x40f6d5
mov cl, 4
test al, 4
je 0x40f3d7
jmp 0x40f2a2
mov cl, 8
test al, 8
je 0x40f3d7
jmp 0x40f2a2
int3
int3
lea esi, [esp + 0x40]
lea ecx, [esp + 0x98]
mov dword [ecx], esi
mov dword [ecx + 4], 0
call fcn.00416f80
mov dword [esp + 4], eax
cmp byte [esi + 8], 0
je 0x40e9bd
lea ecx, [esp + 0x40]
call fcn.004301d0
mov edi, eax
jmp 0x40e9bd
mov ebx, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0x14], ebx
mov eax, ecx
mov dword [esp + 0x10], ecx
test ecx, ecx
jle 0x40f532
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [esp + 8], edx
mov ecx, dword [esp + 4]
shr edx, 1
lea eax, [edx + edx*2]
lea eax, [ebx + eax*4]
cmp dword [eax], ecx
jae 0x40f529
add eax, 0xc
not edx
add edx, dword [esp + 8]
mov ebx, eax
mov dword [esp + 8], edx
test edx, edx
jg 0x40f508
jmp 0x40f532
jne 0x40f51f
cmp dword [eax + 4], edi
jb 0x40f514
jmp 0x40f51f
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*2]
mov ecx, dword [esp + 0x14]
lea eax, [ecx + eax*4]
cmp ebx, eax
je 0x40f555
mov eax, dword [esp + 4]
cmp dword [ebx], eax
ja 0x40f555
cmp dword [ebx + 4], edi
jae 0x40ea50
lea ecx, [esp + 0x98]
mov dword [ecx + 4], edi
mov eax, dword [esp + 4]
mov dword [ecx], eax
mov edi, ecx
push 0x14
call dword [sym.imp.mozglue.dll_moz_xmalloc]
add esp, 4
xorps xmm0, xmm0
movups xmmword [eax + 4], xmm0
mov dword [edi + 8], eax
mov ecx, esi
mov edx, ebx
push edi
call fcn.00430080
add esp, 4
mov ebx, eax
mov eax, dword [edi + 8]
test eax, eax
je 0x40ea50
push eax
call dword [sym.imp.mozglue.dll_free]
add esp, 4
jmp 0x40ea50
mov ecx, edi
call fcn.0041a8c0
test al, al
cmovne esi, edi
jmp 0x40e8fe
mov dword [esp + 0x9c], 0
jmp 0x40ec1f
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xa0]
mov dword [esp], eax
mov al, byte [esp + 0xb4]
mov byte [esp + 4], al
jmp 0x40ec68
mov dword [esp + 4], 0
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov edi, dword [esp + 0x14]
add edi, 4
mov dword [esp + 0x30], edi
jmp 0x40eda5
lea edx, [esp + 0x44]
push edx
push ecx
push dword [edx + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x40f2f2
mov byte [esp + 0x3c], 0
xor ecx, ecx
inc ecx
xor eax, eax
mov dword [esp + 4], ebx
mov edx, ecx
mov esi, dword [esp]
jmp 0x40ed85
mov dword [esp + 4], 0
jmp 0x40eda5
mov dword [esp + 0x30], esi
mov dword [esp + 4], 0
jmp 0x40ee20
xor esi, esi
mov dword [esp + 0x30], esi
push esi
call dword [sym.imp.KERNEL32.dll_EncodePointer]
cmp dword [esp + 0x20], esi
je 0x40fb84
cmp dword [esp + 0x38], 3
jbe 0x40fb91
mov ecx, dword [esp + 0x28]
mov dword [ecx], eax
add dword [esp + 0x30], 4
jmp 0x40f2ae
mov byte [esp + 0x3c], 0
xor eax, eax
mov esi, edi
jmp 0x40edf7
mov dword [esp + 0x30], eax
cmp ebx, 0x64
ja 0x40f2a2
mov ecx, dword [esp + 0xc]
test ecx, ecx
jns 0x40f71d
inc eax
mov esi, eax
add esi, 4
mov dword [esp + 0x30], esi
jmp 0x40f0a1
mov byte [esp + 0x3c], 0
jmp 0x40f010
mov ecx, 2
cmp ebx, 1
je 0x40f6d5
mov ecx, 5
and al, 7
xor edx, edx
cmp al, 4
sete dl
add edx, ecx
jmp 0x40eebc
mov eax, dword [esp]
mov al, byte [eax + edi + 1]
cmp al, 0xc0
jb 0x40f909
add edi, 3
jmp 0x40ef2f
cmp al, 0xff
je 0x40f959
cmp eax, 0xe9
je 0x40f94d
cmp eax, 0x6a
je 0x40f901
jmp 0x40f2a2
mov eax, dword [esp + 0x34]
add ecx, eax
add ecx, 5
cmp ecx, dword [esp + 0x38]
jbe 0x40f929
mov byte [esp + 0x3c], 0
jmp 0x40f0a1
mov byte [esp + 0x3c], 0
jmp 0x40f07a
push esi
call dword [sym.imp.mozglue.dll_free]
add esp, 4
jmp 0x40f28c
push eax
call dword [sym.imp.mozglue.dll_free]
add esp, 4
jmp 0x40f2a2
xor edx, edx
inc edx
mov ecx, esi
call fcn.00430730
test al, al
je 0x40fb19
mov eax, dword [esp + 0xb0]
jmp 0x40f136
mov ecx, esi
mov edx, 4
call fcn.00430730
test al, al
je 0x40fb34
mov eax, dword [esp + 0xb0]
jmp 0x40f176
lea esi, [esp + 0x98]
lea ebx, [esp + 0x74]
mov byte [esp + 0x74], 0x90
mov ecx, esi
mov edx, ebx
call fcn.004306f0
mov eax, dword [esp + 0xa4]
cmp eax, dword [esp + 0xa0]
jae 0x40f1ae
jmp 0x40f7ab
mov cl, 1
test al, 1
je 0x40f3d7
jmp 0x40f2a2
mov edx, edi
jmp 0x40e8f2
mov dword [esp + 4], eax
lea eax, [esp + 0x40]
lea ecx, [esp + 0x98]
mov dword [ecx], eax
mov dword [ecx + 4], 0
call fcn.00416f80
mov dword [esp + 8], eax
lea eax, [esp + 0x40]
cmp byte [eax + 8], 0
je 0x40fb48
lea ecx, [esp + 0x40]
call fcn.004301d0
mov dword [esp], eax
mov eax, dword [0x4393b0]
mov ecx, dword [0x4380f8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x40fb53
mov ecx, dword [0x4393ac]
test ecx, ecx
je 0x40f96f
lea eax, [esp + 0x74]
mov edx, dword [esp + 8]
mov dword [eax], edx
mov edx, dword [esp]
mov dword [eax + 4], edx
xor edx, edx
mov dword [eax + 8], edx
movaps xmm0, xmmword [0x431ff0]
movups xmmword [esp + 0x98], xmm0
mov dword [esp + 0xa0], eax
call dword [section..00cfg]
xor eax, eax
inc eax
push eax
lea edx, [esp + 0x9c]
push edx
push eax
push 0x2000
push esi
xor eax, eax
push eax
push dword [esp + 0x1c]
call ecx
mov dword [edi + 4], eax
test eax, eax
jne 0x40eb0f
jmp 0x40f8b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 4], 0
push 0x439390
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ebx, ebx
jmp 0x40f2f2
mov eax, dword [esp]
mov al, byte [eax + edi + 1]
and al, 0xfe
cmp al, 0x10
jne 0x40f2a2
lea eax, [edi + 2]
lea ecx, [esp + 0x68]
mov dword [ecx + 8], eax
call fcn.00430410
lea ebx, [edi + eax]
add ebx, 2
jmp 0x40eec0
mov eax, dword [esp]
cmp byte [eax + edi + 1], 0xc0
jb 0x40f2a2
add edi, 2
jmp 0x40ef2f
mov ecx, eax
and cl, 0xc0
cmp cl, 0x40
jne 0x40f2a2
and al, 7
cmp al, 4
je 0x40f2a2
add edi, 4
jmp 0x40ef2f
mov ecx, dword [esp + 0xc]
add ecx, eax
inc ecx
mov edx, dword [esp + 0x28]
add eax, dword [esp + 0x2c]
mov esi, dword [esp]
sub esi, eax
add dword [edx + ecx], esi
jmp 0x40f0a1
xor ecx, ecx
inc ecx
jmp 0x40f6d5
lea ebx, [edi + 5]
mov dword [esp + 0xc], edi
jmp 0x40eec0
mov eax, dword [esp]
cmp byte [eax + edi + 1], 0x25
jne 0x40f2a2
add edi, 6
jmp 0x40ef2f
mov eax, dword [esp]
inc eax
mov ecx, dword [esp + 4]
mov edx, esi
mov dword [esp], eax
push eax
push dword [esp + 0xc]
call fcn.00430220
add esp, 8
test eax, eax
je 0x40f8af
push 1
push 0x2000
push esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40eb0c
mov ecx, dword [esp + 4]
mov edx, esi
push dword [esp]
push dword [esp + 0xc]
call fcn.00430220
add esp, 8
test eax, eax
je 0x40f8af
push 1
push 0x2000
push esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40eb0c
mov ecx, dword [esp + 4]
mov edx, esi
push dword [esp]
push dword [esp + 0xc]
call fcn.00430220
add esp, 8
test eax, eax
je 0x40f8af
push 1
push 0x2000
push esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40eb0c
mov ecx, dword [esp + 4]
mov edx, esi
push dword [esp]
push dword [esp + 0xc]
call fcn.00430220
add esp, 8
test eax, eax
je 0x40f8af
push 1
push 0x2000
push esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40eb0c
mov ecx, dword [esp + 4]
mov edx, esi
push dword [esp]
push dword [esp + 0xc]
call fcn.00430220
add esp, 8
test eax, eax
je 0x40f8af
push 1
push 0x2000
push esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40eb0c
mov ecx, dword [esp + 4]
mov edx, esi
push dword [esp]
push dword [esp + 0xc]
call fcn.00430220
add esp, 8
test eax, eax
je 0x40f8af
push 1
push 0x2000
push esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40eb0c
mov ecx, dword [esp + 4]
mov edx, esi
push dword [esp]
push dword [esp + 0xc]
call fcn.00430220
add esp, 8
test eax, eax
je 0x40f8af
push 1
push 0x2000
push esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40eb0c
mov ecx, dword [esp + 4]
mov edx, esi
push dword [esp]
push dword [esp + 0xc]
call fcn.00430220
add esp, 8
test eax, eax
je 0x40f8af
push 1
push 0x2000
push esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40eb0c
jmp 0x40eaf4
mov byte [esp + 0xc8], 0
mov ebx, dword [esp + 0xa4]
mov eax, dword [esp + 0xb0]
jmp 0x40f15f
mov byte [esp + 0xc8], 0
mov eax, dword [esp + 0xa4]
jmp 0x40f1a1
int3
push 0x4393b0
call fcn.0041700a
add esp, 4
cmp dword [0x4393b0], 0xffffffff
jne 0x40f841
call fcn.004303c0
push 0x4393b0
call fcn.00416fc0
add esp, 4
jmp 0x40f841
mov dword [esp + 0x30], 4
jmp 0x40f2ae
mov byte [esp + 0x3c], 0
jmp 0x40f2ae