Function at 0x40dee0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x74
mov eax, dword [0x52d080]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x7c], 0xe9272c5d
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x80], eax
sub eax, 0x829448bb
je 0x40e751
jmp 0x40df10
mov eax, dword [ebp - 0x80]
sub eax, 0x954839df
je 0x40ec21
jmp 0x40df23
mov eax, dword [ebp - 0x80]
sub eax, 0x95bc63c6
je 0x40eec4
jmp 0x40df36
mov eax, dword [ebp - 0x80]
sub eax, 0x9aab44bd
je 0x40e5cc
jmp 0x40df49
mov eax, dword [ebp - 0x80]
sub eax, 0xa22b6a2e
je 0x40eabc
jmp 0x40df5c
mov eax, dword [ebp - 0x80]
sub eax, 0xa6d2495f
je 0x40e5d8
jmp 0x40df6f
mov eax, dword [ebp - 0x80]
sub eax, 0xa8a66e3c
je 0x40e803
jmp 0x40df82
mov eax, dword [ebp - 0x80]
sub eax, 0xb1511344
je 0x40e2e2
jmp 0x40df95
mov eax, dword [ebp - 0x80]
sub eax, 0xb3875024
je 0x40e83b
jmp 0x40dfa8
mov eax, dword [ebp - 0x80]
sub eax, 0xbae284f6
je 0x40ed84
jmp 0x40dfbb
mov eax, dword [ebp - 0x80]
sub eax, 0xbe5a4a60
je 0x40ebcc
jmp 0x40dfce
mov eax, dword [ebp - 0x80]
sub eax, 0xc082949f
je 0x40ebb1
jmp 0x40dfe1
mov eax, dword [ebp - 0x80]
sub eax, 0xc7897ab9
je 0x40e518
jmp 0x40dff4
mov eax, dword [ebp - 0x80]
sub eax, 0xcc8b28e4
je 0x40e5f3
jmp 0x40e007
mov eax, dword [ebp - 0x80]
sub eax, 0xcda759b8
je 0x40ebe0
jmp 0x40e01a
mov eax, dword [ebp - 0x80]
sub eax, 0xda4b15dc
je 0x40e65f
jmp 0x40e02d
mov eax, dword [ebp - 0x80]
sub eax, 0xdb00375b
je 0x40e524
jmp 0x40e040
mov eax, dword [ebp - 0x80]
sub eax, 0xde6690b1
je 0x40eb0e
jmp 0x40e053
mov eax, dword [ebp - 0x80]
sub eax, 0xdf03bc6b
je 0x40edee
jmp 0x40e066
mov eax, dword [ebp - 0x80]
sub eax, 0xe40de245
je 0x40e703
jmp 0x40e079
mov eax, dword [ebp - 0x80]
sub eax, 0xe6dcf521
je 0x40e81e
jmp 0x40e08c
mov eax, dword [ebp - 0x80]
sub eax, 0xe9272c5d
je 0x40e220
jmp 0x40e09f
mov eax, dword [ebp - 0x80]
sub eax, 0xe9346eca
je 0x40ea3f
jmp 0x40e0b2
mov eax, dword [ebp - 0x80]
sub eax, 0xeb1015f5
je 0x40eeb5
jmp 0x40e0c5
mov eax, dword [ebp - 0x80]
sub eax, 0xec12801a
je 0x40e9e5
jmp 0x40e0d8
mov eax, dword [ebp - 0x80]
sub eax, 0xf1b204da
je 0x40eba5
jmp 0x40e0eb
mov eax, dword [ebp - 0x80]
sub eax, 0xfcdd434f
je 0x40e294
jmp 0x40e0fe
mov eax, dword [ebp - 0x80]
sub eax, 0x1a2477c6
je 0x40e8db
jmp 0x40e111
mov eax, dword [ebp - 0x80]
sub eax, 0x1c303a08
je 0x40e46e
jmp 0x40e124
mov eax, dword [ebp - 0x80]
sub eax, 0x274e31bd
je 0x40e9d9
jmp 0x40e137
mov eax, dword [ebp - 0x80]
sub eax, 0x27d04cab
je 0x40e572
jmp 0x40e14a
mov eax, dword [ebp - 0x80]
sub eax, 0x288b5824
je 0x40ed71
jmp 0x40e15d
mov eax, dword [ebp - 0x80]
sub eax, 0x2ca517aa
je 0x40e895
jmp 0x40e170
mov eax, dword [ebp - 0x80]
sub eax, 0x32919fef
je 0x40e4b4
jmp 0x40e183
mov eax, dword [ebp - 0x80]
sub eax, 0x32dc91b7
je 0x40e6f7
jmp 0x40e196
mov eax, dword [ebp - 0x80]
sub eax, 0x3a62bf23
je 0x40eda8
jmp 0x40e1a9
mov eax, dword [ebp - 0x80]
sub eax, 0x41f75c40
je 0x40e9f1
jmp 0x40e1bc
mov eax, dword [ebp - 0x80]
sub eax, 0x4423cf55
je 0x40eb99
jmp 0x40e1cf
mov eax, dword [ebp - 0x80]
sub eax, 0x5f99c262
je 0x40e462
jmp 0x40e1e2
mov eax, dword [ebp - 0x80]
sub eax, 0x632a94ea
je 0x40ed5f
jmp 0x40e1f5
mov eax, dword [ebp - 0x80]
sub eax, 0x6ced8b65
je 0x40eac8
jmp 0x40e208
mov eax, dword [ebp - 0x80]
sub eax, 0x7bad3df1
je 0x40e619
jmp 0x40e21b
jmp 0x40eee7
push eax
mov eax, esp
mov dword [ebp - 0x70], eax
push eax
mov eax, esp
mov dword [ebp - 0x6c], eax
push eax
mov eax, esp
mov dword [ebp - 0x68], eax
push eax
mov eax, esp
mov dword [ebp - 0x64], eax
push eax
mov eax, esp
mov dword [ebp - 0x60], eax
push eax
mov eax, esp
mov dword [ebp - 0x5c], eax
push eax
mov eax, esp
mov dword [ebp - 0x58], eax
push eax
mov eax, esp
mov dword [ebp - 0x54], eax
push eax
mov eax, esp
mov dword [ebp - 0x50], eax
push eax
mov eax, esp
mov dword [ebp - 0x4c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x1c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.0041d840
add esp, 0xc
mov dword [ebp - 0x7c], 0xfcdd434f
jmp 0x40eee7
mov eax, dword [0x52e54c]
mov ecx, dword [0x52e548]
mov edx, eax
add edx, 0x4a93b53c
sub edx, 1
sub edx, 0x4a93b53c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x954839df
mov ecx, 0xb1511344
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40eee7
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x78], eax
mov ecx, dword [ebp - 0x78]
mov edx, dword [ebp - 0x74]
lea eax, [ebp - 0x1c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
lea eax, str.c:windows_system32_ntdll.dll
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x68]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x64]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x60]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
add ecx, 0x3a25caed
add ecx, eax
sub ecx, 0x3a25caed
mov eax, dword [ebp - 0x5c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x58]
mov word [eax], 0
mov eax, dword [0x52e54c]
mov ecx, dword [0x52e548]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x954839df
mov ecx, 0x5f99c262
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40eee7
mov dword [ebp - 0x7c], 0x1c303a08
jmp 0x40eee7
mov eax, dword [0x52e54c]
mov ecx, dword [0x52e548]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x632a94ea
mov ecx, 0x32919fef
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40eee7
mov eax, dword [ebp - 0x58]
movzx eax, word [eax]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov ax, word [eax + 6]
mov word [ebp - 0x44], ax
mov eax, dword [0x52e54c]
mov ecx, dword [0x52e548]
mov edx, eax
add edx, 0xedf7855b
sub edx, 1
sub edx, 0xedf7855b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x632a94ea
mov ecx, 0xc7897ab9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40eee7
mov dword [ebp - 0x7c], 0xdb00375b
jmp 0x40eee7
mov eax, dword [0x52e54c]
mov ecx, dword [0x52e548]
mov edx, eax
add edx, 0xf9c5103c
sub edx, 1
sub edx, 0xf9c5103c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x288b5824
mov ecx, 0x27d04cab
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40eee7
mov ax, word [ebp - 0x44]
movzx ecx, ax
mov eax, dword [ebp - 0x48]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x41], al
mov eax, dword [0x52e54c]
mov ecx, dword [0x52e548]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x288b5824
mov ecx, 0x9aab44bd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40eee7
mov dword [ebp - 0x7c], 0xa6d2495f
jmp 0x40eee7
mov dl, byte [ebp - 0x41]
mov eax, 0xc082949f
mov ecx, 0xcc8b28e4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40eee7
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 0x18
sub eax, ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x7c], 0x7bad3df1
jmp 0x40eee7
mov eax, dword [0x52e54c]
mov ecx, dword [0x52e548]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbae284f6
mov ecx, 0xda4b15dc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40eee7
mov eax, dword [ebp - 0x3c]
movzx ecx, word [eax + 0x10]
mov eax, dword [ebp - 0x40]
add eax, 0xbba51c88
add eax, ecx
sub eax, 0xbba51c88
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x58]
movzx eax, word [eax]
imul eax, eax, 0x28
mov dword [ebp - 0x34], eax
mov ecx, dword [0x52e54c]
mov eax, dword [0x52e548]
mov edx, ecx
add edx, 0x8fe46725
sub edx, 1
sub edx, 0x8fe46725
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbae284f6
mov ecx, 0x32dc91b7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40eee7
mov dword [ebp - 0x7c], 0xe40de245
jmp 0x40eee7
mov eax, dword [0x52e54c]
mov ecx, dword [0x52e548]
mov edx, eax
sub edx, 0xc2c49078
sub edx, 1
add edx, 0xc2c49078
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3a62bf23
mov ecx, 0x829448bb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40eee7
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
sub ecx, 0x54ffc386
add ecx, eax
add ecx, 0x54ffc386
mov eax, dword [ebp - 0x54]
mov dword [eax], ecx
mov eax, dword [ebp - 0x54]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x42ccb1
call fcn.00421140
add esp, 8
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x2d], al
mov ecx, dword [0x52e54c]
mov eax, dword [0x52e548]
mov edx, ecx
sub edx, 0xb210887c
sub edx, 1
add edx, 0xb210887c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3a62bf23
mov ecx, 0xa8a66e3c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40eee7
mov dl, byte [ebp - 0x2d]
mov eax, 0xe6dcf521
mov ecx, 0xec12801a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40eee7
mov eax, dword [ebp - 0x50]
mov dword [eax], 0
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x7c], 0xb3875024
jmp 0x40eee7
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x70]
mov edx, dword [eax]
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub edx, eax
mov eax, dword [ebp - 0x50]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x4c]
mov byte [eax], cl
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x7c], 0x2ca517aa
jmp 0x40eee7
mov eax, dword [0x52e54c]
mov ecx, dword [0x52e548]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdf03bc6b
mov ecx, 0x1a2477c6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40eee7
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov edx, dword [eax + 0xc]
mov ecx, dword [ebp - 0x28]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub ecx, eax
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0041d9a0
add esp, 0xc
mov eax, dword [ebp - 0x50]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x70]
mov esi, dword [eax]
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov edi, dword [eax + 0xc]
xor eax, eax
sub eax, edi
sub esi, eax
mov eax, dword [ebp - 0x50]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x4c]
mov byte [eax], cl
mov ecx, dword [0x52e54c]
mov eax, dword [0x52e548]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xdf03bc6b
mov ecx, 0x274e31bd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40eee7
mov dword [ebp - 0x7c], 0xec12801a
jmp 0x40eee7
mov dword [ebp - 0x7c], 0x41f75c40
jmp 0x40eee7
mov eax, dword [0x52e54c]
mov ecx, dword [0x52e548]
mov edx, eax
sub edx, 0x591b6efa
sub edx, 1
add edx, 0x591b6efa
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xeb1015f5
mov ecx, 0xe9346eca
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40eee7
mov eax, dword [ebp - 0x58]
mov ax, word [eax]
mov word [ebp - 0x22], ax
mov ecx, dword [0x52e54c]
mov eax, dword [0x52e548]
mov edx, ecx
add edx, 0x96c0357c
sub edx, 1
sub edx, 0x96c0357c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xeb1015f5
mov ecx, 0xa22b6a2e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40eee7
mov dword [ebp - 0x7c], 0x6ced8b65
jmp 0x40eee7
mov eax, dword [0x52e54c]
mov ecx, dword [0x52e548]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x95bc63c6
mov ecx, 0xde6690b1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40eee7
mov cx, word [ebp - 0x22]
add cx, 0xc4c7
add cx, 1
sub cx, 0xc4c7
mov eax, dword [ebp - 0x58]
mov word [eax], cx
mov ecx, dword [0x52e54c]
mov eax, dword [0x52e548]
mov edx, ecx
sub edx, 0xf5f99448
sub edx, 1
add edx, 0xf5f99448
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x95bc63c6
mov ecx, 0x4423cf55
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40eee7
mov dword [ebp - 0x7c], 0xf1b204da
jmp 0x40eee7
mov dword [ebp - 0x7c], 0x1c303a08
jmp 0x40eee7
mov eax, dword [ebp - 0x74]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x7c], 0xbe5a4a60
jmp 0x40eee7
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x7c], 0xcda759b8
jmp 0x40eee7
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x78]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041cb50
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x78], eax
mov ecx, dword [ebp - 0x78]
mov edx, dword [ebp - 0x74]
lea eax, [ebp - 0x1c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
lea eax, str.c:windows_system32_ntdll.dll
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x68]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x64]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x60]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov edx, dword [eax + 0x3c]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x5c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x58]
mov word [eax], 0
mov dword [ebp - 0x7c], 0xb1511344
jmp 0x40eee7
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x7c], 0x32919fef
jmp 0x40eee7
mov ax, word [ebp - 0x44]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x7c], 0x27d04cab
jmp 0x40eee7
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x7c], 0xda4b15dc
jmp 0x40eee7
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x54]
mov dword [eax], ecx
mov eax, dword [ebp - 0x54]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x42ccb1
call fcn.00421140
add esp, 8
mov dword [ebp - 0x7c], 0x829448bb
jmp 0x40eee7
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add ecx, 0x3774f86
add ecx, eax
sub ecx, 0x3774f86
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0041d9a0
add esp, 0xc
mov eax, dword [ebp - 0x50]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x70]
mov esi, dword [eax]
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub esi, 0xe285a59
add esi, eax
add esi, 0xe285a59
mov eax, dword [ebp - 0x50]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x4c]
mov byte [eax], cl
mov dword [ebp - 0x7c], 0x1a2477c6
jmp 0x40eee7
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x7c], 0xe9346eca
jmp 0x40eee7
mov ax, word [ebp - 0x22]
mov cx, word [ebp - 0x22]
sub cx, 0x3cfd
add cx, 1
add cx, 0x3cfd
mov eax, dword [ebp - 0x58]
mov word [eax], cx
mov dword [ebp - 0x7c], 0xde6690b1
jmp 0x40defa