Function at 0x40a480
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421518
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x42c00c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, ecx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x50], eax
xor edi, edi
mov eax, 0x490
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x74], eax
xor eax, eax
mov dword [ebp - 0x5c], eax
xor al, al
mov byte [ebp - 0x3d], al
mov byte [ebp - 0x3e], al
xor eax, eax
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x78], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor ecx, ecx
movzx eax, ax
mov dword [ebp - 0x4c], ecx
cmp dword [ebp - 0x44], ecx
jne 0x40a4ff
mov dword [ebp - 0x64], 0x57
xor edi, edi
jmp 0x40ae1e
mov ecx, 0x105
cmp ax, cx
je 0x40a5d9
push str.GetSystemFirmwareTable
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x40a4f8
push 0
push 0
push 0
push 0x52534d42
mov ecx, esi
call dword [0x422284]
call esi
mov edi, eax
test edi, edi
je 0x40a4f8
xor ecx, ecx
add eax, 0x400
setb cl
neg ecx
or ecx, eax
push ecx
call fcn.0041556d
mov ecx, eax
add esp, 4
mov dword [ebp - 0x68], ecx
test ecx, ecx
jne 0x40a573
mov dword [ebp - 0x64], 8
mov edi, eax
jmp 0x40ae1e
lea eax, [edi + 0x400]
push eax
push 0
push ecx
call fcn.00410550
add esp, 0xc
mov ecx, esi
push edi
mov edi, dword [ebp - 0x68]
push edi
push 0
push 0x52534d42
call dword [0x422284]
call esi
test eax, eax
je 0x40ae1e
mov edx, edi
mov al, byte [edx + 1]
mov cl, byte [edx + 2]
mov byte [ebp - 0x3d], al
mov byte [ebp - 0x3e], cl
cmp al, 2
jae 0x40a5c1
mov dword [ebp - 0x64], 0x718
jmp 0x40ae1e
mov eax, dword [edx + 4]
lea edi, [edx + 8]
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x64], 0
jmp 0x40a831
push str.NtOpenSection
push str.ntdll.dll
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], 0x2e002c
mov dword [ebp - 0x20], str.DevicePhysicalMemory
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x40a807
lea eax, [ebp - 0x24]
mov dword [ebp - 0x3c], 0x18
mov dword [ebp - 0x34], eax
mov ecx, esi
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x38], 0
push eax
push 4
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x30], 0x40
push eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
call dword [0x422284]
call esi
test eax, eax
js 0x40a807
push 0x10000
push 0xf0000
push 0
push 4
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov dword [ebp - 0x4c], esi
test esi, esi
je 0x40a809
xor eax, eax
nop dword [eax]
cmp dword [esi], 0x5f4d535f
je 0x40a695
add eax, 0x10
add esi, 0x10
cmp eax, 0x10000
jb 0x40a680
mov ecx, dword [ebp - 0x4c]
mov eax, esi
sub eax, ecx
cmp eax, 0x10000
je 0x40a803
mov al, byte [esi + 5]
cmp al, 0x1f
ja 0x40a803
cmp al, 0x1e
je 0x40a6be
cmp al, 0x1f
jne 0x40a803
movzx eax, al
sub eax, ecx
add eax, esi
cmp eax, 0x10000
ja 0x40a803
movzx eax, word [esi + 0x16]
test ax, ax
je 0x40a803
mov ecx, 0x494d445f
cmp ecx, dword [esi + 0x10]
jne 0x40a7fe
mov ecx, 0x5f
cmp cl, byte [esi + 0x14]
jne 0x40a7fe
mov cl, byte [esi + 6]
mov dl, byte [esi + 7]
mov byte [ebp - 0x3d], cl
mov byte [ebp - 0x3e], dl
cmp cl, 2
jb 0x40a7fe
push dword [ebp - 0x4c]
mov esi, dword [esi + 0x18]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, esi
lea eax, [edi + 0xfff]
and ecx, 0xfff
add eax, ecx
mov dword [ebp - 0x74], ecx
and eax, 0xfffff000
sub esi, ecx
push eax
push esi
push 0
push 4
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov dword [ebp - 0x4c], esi
test esi, esi
je 0x40a7fa
xor ecx, ecx
mov eax, edi
add eax, 0x400
setb cl
neg ecx
or ecx, eax
push ecx
call fcn.0041556d
mov edx, eax
add esp, 4
mov dword [ebp - 0x78], edx
test edx, edx
jne 0x40a783
mov ecx, 8
xor edi, edi
mov dword [ebp - 0x64], ecx
jmp 0x40a80e
lea eax, [edi + 0x400]
push eax
push 0
push edx
call fcn.00410550
mov eax, dword [ebp - 0x74]
push edi
add eax, esi
push eax
push dword [ebp - 0x78]
call fcn.00412210
mov eax, dword [ebp - 0x78]
add esp, 0x18
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x5c], edi
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edi, dword [ebp - 0x70]
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x64], ecx
jmp 0x40a80e
xor edi, edi
jmp 0x40a809
mov esi, dword [ebp - 0x4c]
jmp 0x40a809
mov esi, ecx
jmp 0x40a809
xor esi, esi
mov ecx, 0x490
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40a826
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x64]
test ecx, ecx
jne 0x40ae10
mov eax, dword [ebp - 0x5c]
push 1
lea ecx, [ebp - 0x50]
mov edx, eax
push ecx
push 1
mov ecx, edi
call fcn.0040a3a0
add esp, 0xc
test eax, eax
jne 0x40a87c
mov esi, dword [ebp - 0x50]
mov ecx, esi
mov eax, dword [ebp - 0x44]
add eax, 4
push eax
mov dl, byte [esi + 7]
call fcn.0040a140
mov al, byte [ebp - 0x3d]
add esp, 4
cmp al, 2
ja 0x40a86f
jne 0x40a87c
cmp byte [ebp - 0x3e], 1
jb 0x40a87c
movups xmm0, xmmword [esi + 8]
mov esi, dword [ebp - 0x44]
movups xmmword [esi + 8], xmm0
jmp 0x40a87f
mov esi, dword [ebp - 0x44]
mov edx, dword [ebp - 0x5c]
lea eax, [ebp - 0x50]
push 1
push eax
push 2
mov ecx, edi
call fcn.0040a3a0
add esp, 0xc
test eax, eax
jne 0x40a8bd
lea eax, [esi + 0x18]
mov esi, dword [ebp - 0x50]
push eax
mov ecx, esi
mov dl, byte [esi + 7]
call fcn.0040a140
mov eax, dword [ebp - 0x44]
mov ecx, esi
mov dl, byte [esi + 8]
add eax, 0x1c
push eax
call fcn.0040a140
add esp, 8
mov edx, dword [ebp - 0x5c]
lea eax, [ebp - 0x50]
push 1
push eax
push 3
mov ecx, edi
call fcn.0040a3a0
add esp, 0xc
test eax, eax
jne 0x40a8fe
mov esi, dword [ebp - 0x50]
mov ecx, esi
mov eax, dword [ebp - 0x44]
add eax, 0x20
push eax
mov dl, byte [esi + 7]
call fcn.0040a140
mov eax, dword [ebp - 0x44]
mov ecx, esi
mov dl, byte [esi + 8]
add eax, 0x24
push eax
call fcn.0040a140
add esp, 8
mov edx, dword [ebp - 0x5c]
lea eax, [ebp - 0x50]
push 1
push eax
push 4
mov ecx, edi
call fcn.0040a3a0
add esp, 0xc
test eax, eax
jne 0x40a957
mov esi, dword [ebp - 0x50]
mov edi, dword [ebp - 0x44]
mov eax, dword [esi + 8]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0x2c], eax
mov al, byte [ebp - 0x3d]
cmp al, 2
ja 0x40a938
jne 0x40a957
cmp byte [ebp - 0x3e], 3
jb 0x40a957
mov dl, byte [esi + 0x20]
lea eax, [edi + 0x30]
push eax
mov ecx, esi
call fcn.0040a140
mov dl, byte [esi + 0x21]
lea eax, [edi + 0x34]
push eax
mov ecx, esi
call fcn.0040a140
add esp, 8
mov byte [ebp - 0x45], 1
nop dword [eax + eax]
mov dword [ebp - 4], 2
call fcn.00407230
mov edi, eax
test edi, edi
je 0x40ae5c
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x422284]
mov ecx, edi
call esi
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
mov eax, dword [ebp - 0x70]
mov cl, 1
mov dword [ebp - 4], 3
test eax, eax
je 0x40a9df
mov edx, dword [ebp - 0x5c]
test edx, edx
je 0x40a9df
add edx, eax
mov edi, eax
add eax, 4
cmp eax, edx
ja 0x40a9df
mov ch, byte [ebp - 0x45]
cmp byte [edi], 0x11
jne 0x40a9c1
cmp ch, cl
je 0x40aa79
inc cl
movzx eax, byte [edi + 1]
add eax, edi
cmp byte [eax], 0
jne 0x40a9d2
cmp byte [eax + 1], 0
je 0x40a9d5
inc eax
jmp 0x40a9c7
lea edi, [eax + 2]
add eax, 6
cmp eax, edx
jbe 0x40a9b2
lea ecx, [esi - 0x10]
mov dword [ebp - 4], 4
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x40aa0a
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x422284]
mov ecx, edi
call esi
mov dword [ebp - 4], 0xffffffff
mov dh, byte [ebp - 0x3d]
cmp dh, 2
ja 0x40aa2a
jne 0x40ad85
mov al, byte [ebp - 0x3e]
cmp al, 1
jb 0x40ad90
mov eax, dword [ebp - 0x70]
mov dl, 1
test eax, eax
je 0x40ad82
mov esi, dword [ebp - 0x5c]
test esi, esi
je 0x40ad82
add esi, eax
mov ecx, eax
add eax, 4
cmp eax, esi
ja 0x40ad82
cmp byte [ecx], 0x16
jne 0x40aa61
cmp dl, 1
je 0x40ad6d
inc dl
movzx eax, byte [ecx + 1]
add eax, ecx
cmp byte [eax], 0
jne 0x40aa76
cmp byte [eax + 1], 0
je 0x40ad5d
inc eax
jmp 0x40aa67
mov al, byte [ebp - 0x3d]
cmp al, 2
ja 0x40aa90
jne 0x40ad1c
cmp byte [ebp - 0x3e], 3
jb 0x40ad1c
mov dl, byte [edi + 0x1a]
lea eax, [ebp - 0x18]
push eax
mov ecx, edi
call fcn.0040a140
add esp, 4
test eax, eax
jne 0x40ab6c
mov eax, dword [ebp - 0x44]
mov esi, dword [ebp - 0x18]
mov edx, esi
mov eax, dword [eax + 0x38]
sub edx, eax
mov ecx, dword [esi - 0xc]
mov dword [ebp - 0x60], edx
mov edx, dword [eax - 0xc]
mov dword [ebp - 0x54], edx
test ecx, ecx
js 0x40ae66
test esi, esi
jne 0x40aad2
xor ecx, ecx
jmp 0x40aae1
push ecx
push esi
call fcn.00413305
mov edx, dword [ebp - 0x54]
add esp, 8
mov ecx, eax
mov eax, 0x7fffffff
mov dword [ebp - 0x58], ecx
sub eax, ecx
cmp eax, edx
jl 0x40ae66
add edx, ecx
mov dword [ebp - 0x7c], edx
js 0x40ae66
mov eax, dword [ebp - 0x44]
mov ecx, 1
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x50], eax
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edx
or eax, ecx
jge 0x40ab2c
mov ecx, dword [ebp - 0x44]
push edx
lea ecx, [ecx + 0x38]
call fcn.0040b280
mov edx, dword [ebp - 0x44]
mov ecx, dword [edx + 0x38]
jmp 0x40ab2f
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x60]
mov esi, dword [ebp - 0x60]
add eax, ecx
cmp esi, dword [ebp - 0x54]
mov edx, dword [ebp - 0x58]
cmova eax, dword [ebp - 0x18]
add ecx, dword [ebp - 0x54]
push edx
push eax
call fcn.00406fb0
mov esi, dword [ebp - 0x44]
add esp, 8
mov ecx, dword [ebp - 0x7c]
mov edx, dword [esi + 0x38]
cmp ecx, dword [edx - 8]
jg 0x40ae66
mov dword [edx - 0xc], ecx
mov eax, dword [esi + 0x38]
mov byte [ecx + eax], 0
jmp 0x40ab6f
mov esi, dword [ebp - 0x44]
mov dl, byte [edi + 0x18]
lea eax, [ebp - 0x18]
push eax
mov ecx, edi
call fcn.0040a140
add esp, 4
test eax, eax
jne 0x40ac48
lea eax, [esi + 0x3c]
mov esi, dword [ebp - 0x18]
mov eax, dword [eax]
mov edx, esi
sub edx, eax
mov dword [ebp - 0x58], edx
mov ecx, dword [esi - 0xc]
mov edx, dword [eax - 0xc]
mov dword [ebp - 0x54], edx
test ecx, ecx
js 0x40ae66
test esi, esi
jne 0x40abb0
xor ecx, ecx
jmp 0x40abbf
push ecx
push esi
call fcn.00413305
mov edx, dword [ebp - 0x54]
add esp, 8
mov ecx, eax
mov eax, 0x7fffffff
mov dword [ebp - 0x60], ecx
sub eax, ecx
cmp eax, edx
jl 0x40ae66
add edx, ecx
mov dword [ebp - 0x7c], edx
js 0x40ae66
mov eax, dword [ebp - 0x44]
mov ecx, 1
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x50], eax
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edx
or eax, ecx
jge 0x40ac0a
mov ecx, dword [ebp - 0x44]
push edx
lea ecx, [ecx + 0x3c]
call fcn.0040b280
mov edx, dword [ebp - 0x44]
mov ecx, dword [edx + 0x3c]
jmp 0x40ac0d
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x58]
mov esi, dword [ebp - 0x58]
add eax, ecx
cmp esi, dword [ebp - 0x54]
mov edx, dword [ebp - 0x60]
cmova eax, dword [ebp - 0x18]
add ecx, dword [ebp - 0x54]
push edx
push eax
call fcn.00406fb0
mov esi, dword [ebp - 0x44]
add esp, 8
mov ecx, dword [ebp - 0x7c]
mov edx, dword [esi + 0x3c]
cmp ecx, dword [edx - 8]
jg 0x40ae66
mov dword [edx - 0xc], ecx
mov eax, dword [esi + 0x3c]
mov byte [ecx + eax], 0
mov dl, byte [edi + 0x19]
lea eax, [ebp - 0x18]
push eax
mov ecx, edi
call fcn.0040a140
add esp, 4
test eax, eax
jne 0x40ad19
mov eax, dword [esi + 0x40]
lea ecx, [esi + 0x40]
mov esi, dword [ebp - 0x18]
mov edi, esi
sub edi, eax
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x60], edi
mov edi, dword [eax - 0xc]
mov edx, dword [esi - 0xc]
mov dword [ebp - 0x74], edi
test edx, edx
js 0x40ae66
test esi, esi
jne 0x40ac8d
xor edx, edx
jmp 0x40ac9c
push edx
push esi
call fcn.00413305
mov ecx, dword [ebp - 0x54]
add esp, 8
mov edx, eax
mov eax, 0x7fffffff
mov dword [ebp - 0x58], edx
sub eax, edx
cmp eax, edi
jl 0x40ae66
add edi, edx
js 0x40ae66
mov eax, dword [ecx]
mov ecx, 1
mov dword [ebp - 0x50], eax
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or eax, ecx
jge 0x40acdf
mov ecx, dword [ebp - 0x54]
push edi
call fcn.0040b280
mov eax, dword [ebp - 0x54]
mov edx, dword [ebp - 0x58]
mov ecx, dword [eax]
jmp 0x40ace2
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x60]
push edx
mov edx, dword [ebp - 0x60]
add eax, ecx
cmp edx, dword [ebp - 0x74]
mov edx, dword [ebp - 0x58]
cmova eax, esi
add ecx, dword [ebp - 0x74]
push eax
call fcn.00406fb0
mov eax, dword [ebp - 0x54]
add esp, 8
mov ecx, dword [eax]
cmp edi, dword [ecx - 8]
jg 0x40ae66
mov dword [ecx - 0xc], edi
mov eax, dword [eax]
mov byte [edi + eax], 0
jmp 0x40ad1c
mov esi, dword [ebp - 0x18]
lea ecx, [esi - 0x10]
mov dword [ebp - 4], 5
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x40ad47
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x422284]
mov ecx, edi
call esi
add byte [ebp - 0x45], 1
mov dword [ebp - 4], 0xffffffff
jne 0x40a960
jmp 0x40aa11
lea ecx, [eax + 2]
lea eax, [ecx + 4]
cmp eax, esi
jbe 0x40aa51
jmp 0x40ad82
mov eax, dword [ebp - 0x44]
mov dl, byte [ecx + 7]
add eax, 0x44
push eax
call fcn.0040a140
mov dh, byte [ebp - 0x3d]
add esp, 4
cmp dh, 2
ja 0x40ad94
jne 0x40ae0d
mov al, byte [ebp - 0x3e]
cmp al, 3
jb 0x40ae0d
mov esi, dword [ebp - 0x70]
mov cl, 1
test esi, esi
je 0x40ae0d
mov eax, dword [ebp - 0x5c]
test eax, eax
je 0x40ae0d
lea edx, [eax + esi]
lea eax, [esi + 4]
cmp eax, edx
ja 0x40ae0d
nop
cmp byte [esi], 0x27
jne 0x40adbd
cmp cl, 1
je 0x40addd
add cl, 1
movzx eax, byte [esi + 1]
add eax, esi
cmp byte [eax], 0
jne 0x40adce
cmp byte [eax + 1], 0
je 0x40add1
inc eax
jmp 0x40adc3
lea esi, [eax + 2]
lea eax, [esi + 4]
cmp eax, edx
jbe 0x40adb0
jmp 0x40ae0d
mov edi, dword [ebp - 0x44]
mov ecx, esi
mov dl, byte [esi + 0xa]
lea eax, [edi + 0x48]
push eax
call fcn.0040a140
mov dl, byte [esi + 8]
lea eax, [edi + 0x4c]
push eax
mov ecx, esi
call fcn.0040a140
mov dl, byte [esi + 9]
lea eax, [edi + 0x50]
push eax
mov ecx, esi
call fcn.0040a140
add esp, 0xc
mov esi, dword [ebp - 0x4c]
test esi, esi
je 0x40ae1b
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edi, dword [ebp - 0x68]
push 0
call fcn.00415550
push edi
call fcn.00415550
push dword [ebp - 0x78]
call fcn.00415550
mov eax, dword [ebp - 0x44]
add esp, 0xc
mov ecx, dword [ebp - 0x64]
mov dword [eax], ecx
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040ed1d
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00407070
push 0x80070057
call fcn.00407070
int3