Function at 0x40e7f0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x74
mov eax, dword [0x4e1080]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov ecx, dword [0x4e256c]
mov eax, dword [0x4e2568]
mov edx, ecx
add edx, 0xee62fdc9
sub edx, 1
sub edx, 0xee62fdc9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x72], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x71], al
mov dword [ebp - 0x78], 0x5b2c14f8
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x7c], eax
sub eax, 0x8960c720
je 0x40f6db
jmp 0x40e858
mov eax, dword [ebp - 0x7c]
sub eax, 0x8a02e8f2
je 0x40f30b
jmp 0x40e86b
mov eax, dword [ebp - 0x7c]
sub eax, 0x91bacae9
je 0x40f054
jmp 0x40e87e
mov eax, dword [ebp - 0x7c]
sub eax, 0x96ead202
je 0x40eb8d
jmp 0x40e891
mov eax, dword [ebp - 0x7c]
sub eax, 0x986dc07d
je 0x40ed69
jmp 0x40e8a4
mov eax, dword [ebp - 0x7c]
sub eax, 0x988adfce
je 0x40ef80
jmp 0x40e8b7
mov eax, dword [ebp - 0x7c]
sub eax, 0xa795ed9b
je 0x40f094
jmp 0x40e8ca
mov eax, dword [ebp - 0x7c]
sub eax, 0xae92a8f7
je 0x40f425
jmp 0x40e8dd
mov eax, dword [ebp - 0x7c]
sub eax, 0xaf75ae20
je 0x40ec25
jmp 0x40e8f0
mov eax, dword [ebp - 0x7c]
sub eax, 0xafce9776
je 0x40f710
jmp 0x40e903
mov eax, dword [ebp - 0x7c]
sub eax, 0xbcfe77c4
je 0x40f3c6
jmp 0x40e916
mov eax, dword [ebp - 0x7c]
sub eax, 0xbd7737a0
je 0x40f137
jmp 0x40e929
mov eax, dword [ebp - 0x7c]
sub eax, 0xbf53219c
je 0x40ef37
jmp 0x40e93c
mov eax, dword [ebp - 0x7c]
sub eax, 0xc476840e
je 0x40f54e
jmp 0x40e94f
mov eax, dword [ebp - 0x7c]
sub eax, 0xc5ea0e6c
je 0x40f4e3
jmp 0x40e962
mov eax, dword [ebp - 0x7c]
sub eax, 0xca275b45
je 0x40f531
jmp 0x40e975
mov eax, dword [ebp - 0x7c]
sub eax, 0xd8f732fe
je 0x40ec6b
jmp 0x40e988
mov eax, dword [ebp - 0x7c]
sub eax, 0xe136c349
je 0x40ede8
jmp 0x40e99b
mov eax, dword [ebp - 0x7c]
sub eax, 0xe23bb782
je 0x40f34f
jmp 0x40e9ae
mov eax, dword [ebp - 0x7c]
sub eax, 0xe3180e3e
je 0x40f6e7
jmp 0x40e9c1
mov eax, dword [ebp - 0x7c]
sub eax, 0xec499e97
je 0x40ef43
jmp 0x40e9d4
mov eax, dword [ebp - 0x7c]
sub eax, 0xf69cabe5
je 0x40f0c8
jmp 0x40e9e7
mov eax, dword [ebp - 0x7c]
sub eax, 0xfcfaf4a2
je 0x40f298
jmp 0x40e9fa
mov eax, dword [ebp - 0x7c]
sub eax, 0xfe5478b7
je 0x40f542
jmp 0x40ea0d
mov eax, dword [ebp - 0x7c]
sub eax, 0xda587d6
je 0x40f039
jmp 0x40ea20
mov eax, dword [ebp - 0x7c]
sub eax, 0x16630a65
je 0x40f317
jmp 0x40ea33
mov eax, dword [ebp - 0x7c]
sub eax, 0x172c26c6
je 0x40f339
jmp 0x40ea46
mov eax, dword [ebp - 0x7c]
sub eax, 0x1f6270d0
je 0x40f225
jmp 0x40ea59
mov eax, dword [ebp - 0x7c]
sub eax, 0x20f41871
je 0x40f470
jmp 0x40ea6c
mov eax, dword [ebp - 0x7c]
sub eax, 0x299bc80e
je 0x40f0fb
jmp 0x40ea7f
mov eax, dword [ebp - 0x7c]
sub eax, 0x365a1172
je 0x40f6f3
jmp 0x40ea92
mov eax, dword [ebp - 0x7c]
sub eax, 0x476012a4
je 0x40efce
jmp 0x40eaa5
mov eax, dword [ebp - 0x7c]
sub eax, 0x49994c8f
je 0x40ec19
jmp 0x40eab8
mov eax, dword [ebp - 0x7c]
sub eax, 0x4e918ecc
je 0x40ef60
jmp 0x40eacb
mov eax, dword [ebp - 0x7c]
sub eax, 0x55f6526d
je 0x40f5ce
jmp 0x40eade
mov eax, dword [ebp - 0x7c]
sub eax, 0x5b2c14f8
je 0x40eb42
jmp 0x40eaf1
mov eax, dword [ebp - 0x7c]
sub eax, 0x67a4bfde
je 0x40f35b
jmp 0x40eb04
mov eax, dword [ebp - 0x7c]
sub eax, 0x6cec993a
je 0x40ed75
jmp 0x40eb17
mov eax, dword [ebp - 0x7c]
sub eax, 0x7cc798ce
je 0x40f431
jmp 0x40eb2a
mov eax, dword [ebp - 0x7c]
sub eax, 0x7f95e758
je 0x40f1d5
jmp 0x40eb3d
jmp 0x40f717
mov bl, byte [ebp - 0x72]
mov dh, byte [ebp - 0x71]
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfe5478b7
mov ecx, 0x96ead202
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f717
push eax
mov eax, esp
mov dword [ebp - 0x70], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x6c], eax
push eax
mov eax, esp
mov dword [ebp - 0x68], eax
push eax
mov eax, esp
mov dword [ebp - 0x64], eax
push eax
mov eax, esp
mov dword [ebp - 0x60], eax
push eax
mov eax, esp
mov dword [ebp - 0x5c], eax
push eax
mov eax, esp
mov dword [ebp - 0x58], eax
push eax
mov eax, esp
mov dword [ebp - 0x54], eax
push eax
mov eax, esp
mov dword [ebp - 0x50], eax
push eax
mov eax, esp
mov dword [ebp - 0x4c], eax
mov eax, dword [0x4e256c]
mov ecx, dword [0x4e2568]
mov edx, eax
sub edx, 0x6960d695
sub edx, 1
add edx, 0x6960d695
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfe5478b7
mov ecx, 0x49994c8f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f717
mov dword [ebp - 0x78], 0xaf75ae20
jmp 0x40f717
mov eax, dword [0x4e256c]
mov ecx, dword [0x4e2568]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc476840e
mov ecx, 0xd8f732fe
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f717
push eax
mov eax, esp
mov dword [ebp - 0x48], eax
push eax
mov eax, esp
mov dword [ebp - 0x44], eax
push eax
mov eax, esp
mov dword [ebp - 0x40], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov eax, dword [ebp - 0x6c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.0041eee0
add esp, 0xc
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x68]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x70]
mov edx, dword [eax]
mov eax, dword [ebp - 0x6c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov ecx, dword [0x4e256c]
mov eax, dword [0x4e2568]
mov edx, ecx
add edx, 0xdb9bd36d
sub edx, 1
sub edx, 0xdb9bd36d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc476840e
mov ecx, 0x986dc07d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f717
mov dword [ebp - 0x78], 0x6cec993a
jmp 0x40f717
mov ecx, dword [0x4e256c]
mov eax, dword [0x4e2568]
mov edx, ecx
add edx, 0x71759ad5
sub edx, 1
sub edx, 0x71759ad5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x55f6526d
mov ecx, 0xe136c349
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f717
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x3c]
mov dword [eax], ecx
lea eax, str.c:windows_system32_ntdll.dll
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x60]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x5c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x58]
mov dword [eax], ecx
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x54]
mov dword [eax], ecx
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
sub ecx, 0x5b5bdc6a
add ecx, eax
add ecx, 0x5b5bdc6a
mov eax, dword [ebp - 0x50]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4c]
mov word [eax], 0
mov eax, dword [0x4e256c]
mov ecx, dword [0x4e2568]
mov edx, eax
sub edx, 0x8010178
sub edx, 1
add edx, 0x8010178
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x55f6526d
mov ecx, 0xbf53219c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f717
mov dword [ebp - 0x78], 0xec499e97
jmp 0x40f717
mov eax, dword [ebp - 0x4c]
movzx eax, word [eax]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x78], 0x4e918ecc
jmp 0x40f717
mov eax, dword [ebp - 0x34]
movzx ecx, word [eax + 6]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x2d], al
mov dword [ebp - 0x78], 0x988adfce
jmp 0x40f717
mov eax, dword [0x4e256c]
mov ecx, dword [0x4e2568]
mov edx, eax
add edx, 0x5480cf80
sub edx, 1
sub edx, 0x5480cf80
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8960c720
mov ecx, 0x476012a4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f717
mov ecx, dword [0x4e256c]
mov eax, dword [0x4e2568]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8960c720
mov ecx, 0xda587d6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f717
mov dl, byte [ebp - 0x2d]
mov eax, 0x67a4bfde
mov ecx, 0x91bacae9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f717
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
sub eax, 0x2e5bbca3
add eax, 0x18
add eax, 0x2e5bbca3
mov ecx, dword [ebp - 0x50]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
add eax, 0x9254cf8d
add eax, ecx
sub eax, 0x9254cf8d
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x4c]
mov ax, word [eax]
mov word [ebp - 0x26], ax
mov dword [ebp - 0x78], 0xa795ed9b
jmp 0x40f717
mov ax, word [ebp - 0x26]
movzx eax, ax
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x2c]
sub ecx, 0xb9ea8763
add ecx, eax
add ecx, 0xb9ea8763
mov eax, dword [ebp - 0x48]
mov dword [eax], ecx
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x78], 0xf69cabe5
jmp 0x40f717
mov ecx, dword [ebp - 0x24]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x42dd3d
call fcn.004227e0
add esp, 8
mov edx, eax
mov eax, 0x299bc80e
mov ecx, 0x1f6270d0
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f717
mov eax, dword [ebp - 0x44]
mov dword [eax], 0
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x48]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
sub eax, 0xed5c5cc1
add eax, ecx
add eax, 0xed5c5cc1
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x78], 0xbd7737a0
jmp 0x40f717
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x20]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x40]
mov byte [eax], cl
mov eax, dword [ebp - 0x64]
mov edx, dword [eax]
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub edx, 0x7b00a706
add edx, eax
add edx, 0x7b00a706
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub ecx, eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0041f040
add esp, 0xc
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
add eax, 8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x78], 0x7f95e758
jmp 0x40f717
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
mov eax, dword [ebp - 0x64]
mov esi, dword [eax]
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
sub esi, eax
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x18]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x40]
mov byte [eax], cl
mov dword [ebp - 0x78], 0x1f6270d0
jmp 0x40f717
mov ecx, dword [0x4e256c]
mov eax, dword [0x4e2568]
mov edx, ecx
sub edx, 0x4c06c757
sub edx, 1
add edx, 0x4c06c757
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe3180e3e
mov ecx, 0xfcfaf4a2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f717
mov ecx, dword [0x4e256c]
mov eax, dword [0x4e2568]
mov edx, ecx
sub edx, 0xc7fd02a3
sub edx, 1
add edx, 0xc7fd02a3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe3180e3e
mov ecx, 0x8a02e8f2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f717
mov dword [ebp - 0x78], 0x16630a65
jmp 0x40f717
mov eax, dword [ebp - 0x4c]
mov ax, word [eax]
add ax, 0x426e
add ax, 1
sub ax, 0x426e
mov word [ebp - 0xe], ax
mov dword [ebp - 0x78], 0x172c26c6
jmp 0x40f717
mov eax, dword [ebp - 0x4c]
mov cx, word [ebp - 0xe]
mov word [eax], cx
mov dword [ebp - 0x78], 0xe23bb782
jmp 0x40f717
mov dword [ebp - 0x78], 0xec499e97
jmp 0x40f717
mov ecx, dword [0x4e256c]
mov eax, dword [0x4e2568]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x365a1172
mov ecx, 0xbcfe77c4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f717
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4e256c]
mov ecx, dword [0x4e2568]
mov edx, eax
add edx, 0x84c80a0c
sub edx, 1
sub edx, 0x84c80a0c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x365a1172
mov ecx, 0xae92a8f7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f717
mov dword [ebp - 0x78], 0x7cc798ce
jmp 0x40f717
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x78], 0x20f41871
jmp 0x40f717
mov ecx, dword [0x4e256c]
mov eax, dword [0x4e2568]
mov edx, ecx
sub edx, 0x28005a71
sub edx, 1
add edx, 0x28005a71
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xafce9776
mov ecx, 0xc5ea0e6c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f717
mov eax, dword [0x4e256c]
mov ecx, dword [0x4e2568]
mov edx, eax
add edx, 0x6d5dc195
sub edx, 1
sub edx, 0x6d5dc195
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xafce9776
mov ecx, 0xca275b45
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f717
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0041e1d0
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov dword [ebp - 0x78], 0x96ead202
jmp 0x40f717
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov eax, dword [ebp - 0x6c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.0041eee0
add esp, 0xc
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x68]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x70]
mov edx, dword [eax]
mov eax, dword [ebp - 0x6c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x78], 0xd8f732fe
jmp 0x40f717
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x3c]
mov dword [eax], ecx
lea eax, str.c:windows_system32_ntdll.dll
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x60]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x5c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x58]
mov dword [eax], ecx
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x54]
mov dword [eax], ecx
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov edx, dword [eax + 0x3c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x50]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4c]
mov word [eax], 0
mov dword [ebp - 0x78], 0xe136c349
jmp 0x40f717
mov dword [ebp - 0x78], 0x476012a4
jmp 0x40f717
mov dword [ebp - 0x78], 0xfcfaf4a2
jmp 0x40f717
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x78], 0xbcfe77c4
jmp 0x40f717
mov dword [ebp - 0x78], 0xc5ea0e6c
jmp 0x40e842