Function at 0x4124c0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x9c
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa0], eax
mov eax, dword [0x443080]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x9c], 0x94d964c7
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xa4], eax
sub eax, 0x87a5c17c
je 0x412f55
jmp 0x412504
mov eax, dword [ebp - 0xa4]
sub eax, 0x92176a57
je 0x412bde
jmp 0x41251a
mov eax, dword [ebp - 0xa4]
sub eax, 0x94d964c7
je 0x412997
jmp 0x412530
mov eax, dword [ebp - 0xa4]
sub eax, 0x95f1fb6c
je 0x4134c2
jmp 0x412546
mov eax, dword [ebp - 0xa4]
sub eax, 0x979329fd
je 0x413671
jmp 0x41255c
mov eax, dword [ebp - 0xa4]
sub eax, 0x99744783
je 0x412cd8
jmp 0x412572
mov eax, dword [ebp - 0xa4]
sub eax, 0xa48ddce7
je 0x413424
jmp 0x412588
mov eax, dword [ebp - 0xa4]
sub eax, 0xa6d844cb
je 0x413024
jmp 0x41259e
mov eax, dword [ebp - 0xa4]
sub eax, 0xa831bf05
je 0x413129
jmp 0x4125b4
mov eax, dword [ebp - 0xa4]
sub eax, 0xad9b9836
je 0x412e5e
jmp 0x4125ca
mov eax, dword [ebp - 0xa4]
sub eax, 0xb0d64d0b
je 0x4130a9
jmp 0x4125e0
mov eax, dword [ebp - 0xa4]
sub eax, 0xb711ac0d
je 0x412d5c
jmp 0x4125f6
mov eax, dword [ebp - 0xa4]
sub eax, 0xc2d1f10a
je 0x4132eb
jmp 0x41260c
mov eax, dword [ebp - 0xa4]
sub eax, 0xc4578036
je 0x412cba
jmp 0x412622
mov eax, dword [ebp - 0xa4]
sub eax, 0xcb5aa83e
je 0x4130ee
jmp 0x412638
mov eax, dword [ebp - 0xa4]
sub eax, 0xcc47f31b
je 0x412fb5
jmp 0x41264e
mov eax, dword [ebp - 0xa4]
sub eax, 0xd2086b78
je 0x41304a
jmp 0x412664
mov eax, dword [ebp - 0xa4]
sub eax, 0xdb6c6a7c
je 0x413015
jmp 0x41267a
mov eax, dword [ebp - 0xa4]
sub eax, 0xdbf48687
je 0x412f64
jmp 0x412690
mov eax, dword [ebp - 0xa4]
sub eax, 0xdc512797
je 0x412d37
jmp 0x4126a6
mov eax, dword [ebp - 0xa4]
sub eax, 0xe18b521e
je 0x413109
jmp 0x4126bc
mov eax, dword [ebp - 0xa4]
sub eax, 0xe4b8169f
je 0x412b5d
jmp 0x4126d2
mov eax, dword [ebp - 0xa4]
sub eax, 0xe6dce52b
je 0x412a77
jmp 0x4126e8
mov eax, dword [ebp - 0xa4]
sub eax, 0xe7738c12
je 0x4134f8
jmp 0x4126fe
mov eax, dword [ebp - 0xa4]
sub eax, 0xf8cbbad9
je 0x4135f6
jmp 0x412714
mov eax, dword [ebp - 0xa4]
sub eax, 0x92197
je 0x412ac8
jmp 0x41272a
mov eax, dword [ebp - 0xa4]
sub eax, 0xe27819
je 0x4135bd
jmp 0x412740
mov eax, dword [ebp - 0xa4]
sub eax, 0x8d8893b
je 0x412e40
jmp 0x412756
mov eax, dword [ebp - 0xa4]
sub eax, 0x11d8b0f8
je 0x412c2f
jmp 0x41276c
mov eax, dword [ebp - 0xa4]
sub eax, 0x13213f3f
je 0x412ce7
jmp 0x412782
mov eax, dword [ebp - 0xa4]
sub eax, 0x15aee4d2
je 0x412dd2
jmp 0x412798
mov eax, dword [ebp - 0xa4]
sub eax, 0x1a4fde54
je 0x413614
jmp 0x4127ae
mov eax, dword [ebp - 0xa4]
sub eax, 0x2a74653b
je 0x41321c
jmp 0x4127c4
mov eax, dword [ebp - 0xa4]
sub eax, 0x2e79fd32
je 0x4135d2
jmp 0x4127da
mov eax, dword [ebp - 0xa4]
sub eax, 0x31094564
je 0x41315b
jmp 0x4127f0
mov eax, dword [ebp - 0xa4]
sub eax, 0x3932b793
je 0x412ed4
jmp 0x412806
mov eax, dword [ebp - 0xa4]
sub eax, 0x3a85c6c8
je 0x4129bd
jmp 0x41281c
mov eax, dword [ebp - 0xa4]
sub eax, 0x3d41e00f
je 0x4134a9
jmp 0x412832
mov eax, dword [ebp - 0xa4]
sub eax, 0x407e6d7a
je 0x412b4e
jmp 0x412848
mov eax, dword [ebp - 0xa4]
sub eax, 0x50dd6214
je 0x413568
jmp 0x41285e
mov eax, dword [ebp - 0xa4]
sub eax, 0x5295bcca
je 0x4132fa
jmp 0x412874
mov eax, dword [ebp - 0xa4]
sub eax, 0x52aa40c7
je 0x413033
jmp 0x41288a
mov eax, dword [ebp - 0xa4]
sub eax, 0x561568c4
je 0x4135e1
jmp 0x4128a0
mov eax, dword [ebp - 0xa4]
sub eax, 0x5817e921
je 0x412a68
jmp 0x4128b6
mov eax, dword [ebp - 0xa4]
sub eax, 0x5915aa3f
je 0x4130d6
jmp 0x4128cc
mov eax, dword [ebp - 0xa4]
sub eax, 0x5d0a6d86
je 0x4134e9
jmp 0x4128e2
mov eax, dword [ebp - 0xa4]
sub eax, 0x676defc2
je 0x4133d3
jmp 0x4128f8
mov eax, dword [ebp - 0xa4]
sub eax, 0x6903415d
je 0x413512
jmp 0x41290e
mov eax, dword [ebp - 0xa4]
sub eax, 0x6aa0107b
je 0x41354a
jmp 0x412924
mov eax, dword [ebp - 0xa4]
sub eax, 0x6c5693d4
je 0x413392
jmp 0x41293a
mov eax, dword [ebp - 0xa4]
sub eax, 0x6d6d5dd4
je 0x41349a
jmp 0x412950
mov eax, dword [ebp - 0xa4]
sub eax, 0x7aa10ee8
je 0x413173
jmp 0x412966
mov eax, dword [ebp - 0xa4]
sub eax, 0x7c6cf181
je 0x413579
jmp 0x41297c
mov eax, dword [ebp - 0xa4]
sub eax, 0x7e15c172
je 0x4131d3
jmp 0x412992
jmp 0x41367b
push eax
mov eax, esp
mov dword [ebp - 0x8c], eax
sub esp, 0x104
mov eax, esp
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x9c], 0x3a85c6c8
jmp 0x41367b
mov eax, dword [ebp - 0xa0]
push eax
mov ecx, esp
mov dword [ebp - 0x84], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x80], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x7c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x78], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x74], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x70], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x6c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x68], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x90], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x94], eax
lea eax, [ebp - 0x18]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.0042cc30
add esp, 0xc
mov eax, dword [ebp - 0x90]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x98], eax
mov eax, 0x5817e921
mov ecx, 0xe6dce52b
cmp dword [ebp - 0x98], 0
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x41367b
mov dword [ebp - 0x9c], 0x50dd6214
jmp 0x41367b
mov eax, dword [0x444594]
mov ecx, dword [0x444590]
mov edx, eax
add edx, 0x4402c619
sub edx, 1
sub edx, 0x4402c619
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7c6cf181
mov ecx, 0x92197
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x41367b
mov ecx, dword [ebp - 0x98]
mov edx, dword [ebp - 0x94]
lea eax, [ebp - 0x18]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
mov eax, dword [0x444594]
mov ecx, dword [0x444590]
mov edx, eax
add edx, 0x71e76a7a
sub edx, 1
sub edx, 0x71e76a7a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7c6cf181
mov ecx, 0x407e6d7a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x41367b
mov dword [ebp - 0x9c], 0xe4b8169f
jmp 0x41367b
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x98]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x88]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x84]
mov dword [eax], ecx
mov dword [ebp - 0x9c], 0x92176a57
jmp 0x41367b
mov eax, dword [0x444594]
mov ecx, dword [0x444590]
mov edx, eax
sub edx, 0xc69f816
sub edx, 1
add edx, 0xc69f816
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe27819
mov ecx, 0x11d8b0f8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x41367b
mov eax, dword [ebp - 0x84]
mov ecx, 0xffffffff
cmp dword [eax], ecx
sete al
and al, 1
mov byte [ebp - 0x5d], al
mov ecx, dword [0x444594]
mov eax, dword [0x444590]
mov edx, ecx
add edx, 0x6c08dc16
sub edx, 1
sub edx, 0x6c08dc16
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe27819
mov ecx, 0xc4578036
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x41367b
mov dl, byte [ebp - 0x5d]
mov eax, 0x13213f3f
mov ecx, 0x99744783
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x41367b
mov dword [ebp - 0x9c], 0x50dd6214
jmp 0x41367b
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x9c], 0xdc512797
jmp 0x41367b
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x5c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x55], al
mov dword [ebp - 0x9c], 0xb711ac0d
jmp 0x41367b
mov ecx, dword [0x444594]
mov eax, dword [0x444590]
mov edx, ecx
sub edx, 0xf141faf6
sub edx, 1
add edx, 0xf141faf6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2e79fd32
mov ecx, 0x15aee4d2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x41367b
mov ecx, dword [0x444594]
mov eax, dword [0x444590]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2e79fd32
mov ecx, 0x8d8893b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x41367b
mov dl, byte [ebp - 0x55]
mov eax, 0xad9b9836
mov ecx, 0x52aa40c7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x41367b
mov ecx, dword [0x444594]
mov eax, dword [0x444590]
mov edx, ecx
add edx, 0xb41abc8f
sub edx, 1
sub edx, 0xb41abc8f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x561568c4
mov ecx, 0x3932b793
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x41367b
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov ecx, dword [0x444594]
mov eax, dword [0x444590]
mov edx, ecx
sub edx, 0xea19013f
sub edx, 1
add edx, 0xea19013f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x561568c4
mov ecx, 0x87a5c17c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x41367b
mov dword [ebp - 0x9c], 0xdbf48687
jmp 0x41367b
mov eax, dword [0x444594]
mov ecx, dword [0x444590]
mov edx, eax
sub edx, 0x3e4d76e7
sub edx, 1
add edx, 0x3e4d76e7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf8cbbad9
mov ecx, 0xcc47f31b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x41367b
mov eax, dword [ebp - 0x54]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x444594]
mov ecx, dword [0x444590]
mov edx, eax
add edx, 0xe2a2a2f9
sub edx, 1
sub edx, 0xe2a2a2f9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf8cbbad9
mov ecx, 0xdb6c6a7c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x41367b
mov dword [ebp - 0x9c], 0xa6d844cb
jmp 0x41367b
mov dword [ebp - 0x9c], 0x50dd6214
jmp 0x41367b
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x9c], 0xd2086b78
jmp 0x41367b
mov eax, dword [ebp - 0x50]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x78]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x9c], 0xb0d64d0b
jmp 0x41367b
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov edx, dword [eax + 0x3c]
mov ecx, dword [ebp - 0x4c]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
mov word [eax], 0
mov dword [ebp - 0x9c], 0x5915aa3f
jmp 0x41367b
mov eax, dword [ebp - 0x70]
movzx eax, word [eax]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x9c], 0xcb5aa83e
jmp 0x41367b
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
movzx eax, word [eax + 6]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x9c], 0xe18b521e
jmp 0x41367b
mov edx, dword [ebp - 0x48]
mov esi, dword [ebp - 0x44]
mov eax, 0xe7738c12
mov ecx, 0xa831bf05
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x41367b
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
add eax, 0x61269ad0
add eax, 0x18
sub eax, 0x61269ad0
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
add eax, 4
add eax, 0x10
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x9c], 0x31094564
jmp 0x41367b
mov eax, dword [ebp - 0x3c]
movzx eax, word [eax]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x9c], 0x7aa10ee8
jmp 0x41367b
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x38]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x70]
movzx eax, word [eax]
imul eax, eax, 0x28
sub ecx, 0x5fcd006d
add ecx, eax
add ecx, 0x5fcd006d
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x43bfba
call fcn.00430530
add esp, 8
mov edx, eax
mov eax, 0x7e15c172
mov ecx, 0x676defc2
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x41367b
mov eax, dword [0x444594]
mov ecx, dword [0x444590]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1a4fde54
mov ecx, 0x2a74653b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x41367b
mov eax, dword [ebp - 0x68]
mov dword [eax], 0
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x8c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub edx, 0xf9b1f675
add edx, eax
add edx, 0xf9b1f675
mov eax, dword [ebp - 0x68]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x31], al
mov ecx, dword [0x444594]
mov eax, dword [0x444590]
mov edx, ecx
add edx, 0x1dba93d5
sub edx, 1
sub edx, 0x1dba93d5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1a4fde54
mov ecx, 0xc2d1f10a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x41367b
mov dword [ebp - 0x9c], 0x5295bcca
jmp 0x41367b
mov eax, dword [ebp - 0x64]
mov cl, byte [ebp - 0x31]
mov byte [eax], cl
mov eax, dword [ebp - 0x8c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
sub edx, eax
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub ecx, 0xbc71865
add ecx, eax
add ecx, 0xbc71865
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0042cd90
add esp, 0xc
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x6c]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
sub eax, 0x7479d6cf
add eax, ecx
add eax, 0x7479d6cf
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x9c], 0x6c5693d4
jmp 0x41367b
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x64]
mov byte [eax], cl
mov dword [ebp - 0x9c], 0x676defc2
jmp 0x41367b
mov eax, dword [0x444594]
mov ecx, dword [0x444590]
mov edx, eax
sub edx, 0x94f493ad
sub edx, 1
add edx, 0x94f493ad
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x979329fd
mov ecx, 0xa48ddce7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x41367b
mov ecx, dword [0x444594]
mov eax, dword [0x444590]
mov edx, ecx
add edx, 0xfee9c1f2
sub edx, 1
sub edx, 0xfee9c1f2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x979329fd
mov ecx, 0x6d6d5dd4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x41367b
mov dword [ebp - 0x9c], 0x3d41e00f
jmp 0x41367b
mov eax, dword [ebp - 0x70]
mov ax, word [eax]
mov word [ebp - 0x22], ax
mov dword [ebp - 0x9c], 0x95f1fb6c
jmp 0x41367b
mov cx, word [ebp - 0x22]
add cx, 0xc578
add cx, 1
sub cx, 0xc578
mov eax, dword [ebp - 0x70]
mov word [eax], cx
mov dword [ebp - 0x9c], 0x5d0a6d86
jmp 0x41367b
mov dword [ebp - 0x9c], 0x5915aa3f
jmp 0x41367b
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x9c], 0x6903415d
jmp 0x41367b
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x9c], 0x6aa0107b
jmp 0x41367b
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x9c], 0x50dd6214
jmp 0x41367b
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0042bf40
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov ecx, dword [ebp - 0x98]
mov edx, dword [ebp - 0x94]
lea eax, [ebp - 0x18]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
mov dword [ebp - 0x9c], 0x92197
jmp 0x41367b
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x9c], 0x11d8b0f8
jmp 0x41367b
mov dword [ebp - 0x9c], 0x15aee4d2
jmp 0x41367b
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x9c], 0x3932b793
jmp 0x41367b
mov eax, dword [ebp - 0x54]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x9c], 0xcc47f31b
jmp 0x41367b
mov eax, dword [ebp - 0x68]
mov dword [eax], 0
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x8c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub edx, 0x30760d60
add edx, eax
add edx, 0x30760d60
mov eax, dword [ebp - 0x68]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x9c], 0x2a74653b
jmp 0x41367b
mov dword [ebp - 0x9c], 0xa48ddce7
jmp 0x4124e8