Function at 0x43e150
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47c26d
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x49d034]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x64], edi
mov eax, 0x490
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x84], eax
xor eax, eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x8c], eax
xor al, al
mov byte [ebp - 0x45], al
mov byte [ebp - 0x51], al
mov byte [ebp - 0x46], al
mov byte [ebp - 0x52], al
xor eax, eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x80], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
movzx eax, ax
mov dword [ebp - 0x78], 0
test edi, edi
jne 0x43e1e0
lea esi, [edi + 0x57]
jmp 0x43eadd
mov ecx, 0x105
cmp ax, cx
je 0x43e2bf
push str.GetSystemFirmwareTable
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x43eb1a
push 0
push 0
push 0
push 0x52534d42
mov ecx, esi
call dword [0x47d428]
call esi
mov edi, eax
test edi, edi
je 0x43eb17
xor ecx, ecx
add eax, 0x400
setb cl
neg ecx
or ecx, eax
push ecx
call fcn.00454c58
add esp, 4
mov ecx, eax
mov dword [ebp - 0x7c], ecx
test ecx, ecx
jne 0x43e259
lea esi, [eax + 8]
mov edi, dword [ebp - 0x4c]
jmp 0x43eadd
lea eax, [edi + 0x400]
push eax
push 0
push ecx
call fcn.00451b90
add esp, 0xc
push edi
mov edi, dword [ebp - 0x7c]
push edi
push 0
push 0x52534d42
mov ecx, esi
call dword [0x47d428]
call esi
test eax, eax
je 0x43eb17
mov al, byte [edi + 1]
mov byte [ebp - 0x45], al
mov cl, byte [edi + 2]
mov byte [ebp - 0x46], cl
cmp al, 2
jae 0x43e2a6
mov esi, 0x718
mov edi, dword [ebp - 0x4c]
jmp 0x43eadd
lea eax, [edi + 8]
mov dword [ebp - 0x5c], eax
mov ecx, dword [edi + 4]
mov dword [ebp - 0x58], ecx
xor esi, esi
mov dword [ebp - 0x60], esi
mov edi, dword [ebp - 0x4c]
jmp 0x43e546
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x44], 0x2e002c
mov dword [ebp - 0x40], str.DevicePhysicalMemory
mov dword [ebp - 4], 0
push str.NtOpenSection
push 0x4895c0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x43e4d9
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x44]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 0x40
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x30]
push eax
push 4
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call dword [0x47d428]
call esi
test eax, eax
js 0x43e4d9
push 0x10000
push 0xf0000
push 0
push 4
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, eax
mov dword [ebp - 0x78], edx
test edx, edx
je 0x43e4d9
mov esi, edx
mov dword [ebp - 0x90], esi
mov eax, esi
sub eax, edx
cmp eax, 0x10000
jae 0x43e385
cmp dword [esi], 0x5f4d535f
je 0x43e38b
add esi, 0x10
jmp 0x43e367
je 0x43e4d9
mov al, byte [esi + 5]
cmp al, 0x1f
ja 0x43e4d9
cmp al, 0x1e
je 0x43e3a2
cmp al, 0x1f
jne 0x43e4d9
movzx eax, al
sub eax, edx
add eax, esi
cmp eax, 0x10000
ja 0x43e4d9
movzx eax, word [esi + 0x16]
test ax, ax
je 0x43e4d9
mov ecx, 0x494d445f
cmp ecx, dword [esi + 0x10]
jne 0x43e4d9
mov ecx, 0x5f
cmp cl, byte [esi + 0x14]
jne 0x43e4d9
mov cl, byte [esi + 6]
mov byte [ebp - 0x45], cl
mov byte [ebp - 0x51], cl
mov ch, byte [esi + 7]
mov byte [ebp - 0x46], ch
mov byte [ebp - 0x52], ch
cmp cl, 2
jb 0x43e4d9
mov esi, dword [esi + 0x18]
mov edi, eax
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, esi
and ecx, 0xfff
mov dword [ebp - 0x50], ecx
lea eax, [edi + 0xfff]
add eax, ecx
and eax, 0xfffff000
push eax
sub esi, ecx
push esi
push 0
push 4
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov dword [ebp - 0x78], esi
test esi, esi
je 0x43e4d6
xor ecx, ecx
mov eax, edi
add eax, 0x400
setb cl
neg ecx
or ecx, eax
push ecx
call fcn.00454c58
add esp, 4
mov ecx, eax
mov dword [ebp - 0x80], ecx
test ecx, ecx
jne 0x43e479
mov ecx, 8
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x84], ecx
mov edi, dword [ebp - 0x4c]
mov dword [ebp - 4], 0xffffffff
jmp 0x43e527
lea eax, [edi + 0x400]
push eax
push 0
push ecx
call fcn.00451b90
push edi
mov eax, dword [ebp - 0x50]
add eax, esi
push eax
push dword [ebp - 0x80]
call fcn.00451610
add esp, 0x18
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x88], eax
mov eax, edi
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x8c], eax
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x78], 0
xor ecx, ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x84], ecx
mov edi, dword [ebp - 0x4c]
mov dword [ebp - 4], 0xffffffff
jmp 0x43e527
mov edi, dword [ebp - 0x4c]
mov ecx, 0x490
mov dword [ebp - 4], 0xffffffff
jmp 0x43e527
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x43e538
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x60]
test ecx, ecx
jne 0x43eacc
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x58]
push 1
lea edx, [ebp - 0x50]
push edx
push 0
mov edx, ecx
mov ecx, eax
call fcn.0043e070
add esp, 0xc
test eax, eax
jne 0x43e616
mov dword [ebp - 0x18], eax
call fcn.00409480
mov ecx, eax
test ecx, ecx
je 0x43eb2b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 3
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x50]
mov dl, byte [ecx + 8]
call fcn.0043dec0
add esp, 4
mov esi, dword [ebp - 0x18]
test eax, eax
jne 0x43e5f5
xorps xmm0, xmm0
movups xmmword [ebp - 0x3c], xmm0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
push str._d__d__d
push esi
call fcn.0043edf0
add esp, 0x14
cmp eax, 3
jne 0x43e5f5
dec dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
cmp eax, 0x76c
jl 0x43e5e3
sub eax, 0x76c
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00466435
add esp, 4
mov dword [edi + 0x58], eax
mov dword [edi + 0x5c], edx
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x43e616
mov ecx, dword [esi]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
push esi
call eax
push 1
lea eax, [ebp - 0x50]
push eax
push 1
mov edx, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x5c]
call fcn.0043e070
add esp, 0xc
test eax, eax
jne 0x43e65a
lea eax, [edi + 4]
push eax
mov esi, dword [ebp - 0x50]
mov dl, byte [esi + 7]
mov ecx, esi
call fcn.0043dec0
add esp, 4
cmp byte [ebp - 0x45], 2
ja 0x43e652
jne 0x43e65a
cmp byte [ebp - 0x46], 1
jb 0x43e65a
movups xmm0, xmmword [esi + 8]
movups xmmword [edi + 8], xmm0
push 1
lea eax, [ebp - 0x50]
push eax
push 2
mov edx, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x5c]
call fcn.0043e070
add esp, 0xc
test eax, eax
jne 0x43e696
lea eax, [edi + 0x18]
push eax
mov esi, dword [ebp - 0x50]
mov dl, byte [esi + 7]
mov ecx, esi
call fcn.0043dec0
lea eax, [edi + 0x1c]
push eax
mov dl, byte [esi + 8]
mov ecx, esi
call fcn.0043dec0
add esp, 8
push 1
lea eax, [ebp - 0x50]
push eax
push 3
mov edx, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x5c]
call fcn.0043e070
add esp, 0xc
test eax, eax
jne 0x43e6d2
lea eax, [edi + 0x20]
push eax
mov esi, dword [ebp - 0x50]
mov dl, byte [esi + 7]
mov ecx, esi
call fcn.0043dec0
lea eax, [edi + 0x24]
push eax
mov dl, byte [esi + 8]
mov ecx, esi
call fcn.0043dec0
add esp, 8
push 1
lea eax, [ebp - 0x50]
push eax
push 4
mov edx, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x5c]
call fcn.0043e070
add esp, 0xc
test eax, eax
jne 0x43e728
mov esi, dword [ebp - 0x50]
mov eax, dword [esi + 8]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0x2c], eax
cmp byte [ebp - 0x45], 2
ja 0x43e709
jne 0x43e728
cmp byte [ebp - 0x46], 3
jb 0x43e728
lea eax, [edi + 0x30]
push eax
mov dl, byte [esi + 0x20]
mov ecx, esi
call fcn.0043dec0
lea eax, [edi + 0x34]
push eax
mov dl, byte [esi + 0x21]
mov ecx, esi
call fcn.0043dec0
add esp, 8
mov byte [ebp - 0x68], 1
nop dword [eax]
mov dword [ebp - 0x18], 0
call fcn.00409480
mov ecx, eax
test ecx, ecx
je 0x43eb2b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 6
push dword [ebp - 0x68]
lea eax, [ebp - 0x64]
push eax
push 0x11
mov edx, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x5c]
call fcn.0043e070
add esp, 0xc
test eax, eax
jne 0x43ea06
cmp byte [ebp - 0x45], 2
ja 0x43e78f
jne 0x43e9d7
cmp byte [ebp - 0x46], 3
jb 0x43e9d7
lea eax, [ebp - 0x18]
push eax
mov esi, dword [ebp - 0x64]
mov dl, byte [esi + 0x1a]
mov ecx, esi
call fcn.0043dec0
add esp, 4
test eax, eax
jne 0x43e84e
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x74], ecx
mov eax, dword [edi + 0x38]
mov edx, ecx
sub edx, eax
mov dword [ebp - 0x70], edx
mov esi, dword [eax - 0xc]
mov dword [ebp - 0x6c], esi
mov eax, dword [ecx - 0xc]
test eax, eax
js 0x43eb21
push eax
push ecx
call fcn.00454da4
add esp, 8
mov ecx, eax
mov dword [ebp - 0x50], ecx
mov eax, SysReAllocString
sub eax, ecx
cmp eax, esi
jl 0x43eb21
add esi, ecx
js 0x43eb21
mov edx, dword [edi + 0x38]
mov ecx, 1
sub ecx, dword [edx - 4]
mov eax, dword [edx - 8]
sub eax, esi
or eax, ecx
jge 0x43e812
push esi
lea ecx, [edi + 0x38]
call fcn.00408cb5
mov edx, dword [edi + 0x38]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x70]
cmp ecx, eax
ja 0x43e820
add ecx, edx
jmp 0x43e823
mov ecx, dword [ebp - 0x74]
push dword [ebp - 0x50]
push ecx
lea ecx, [eax + edx]
mov edx, dword [ebp - 0x50]
call fcn.00409000
add esp, 8
mov eax, dword [edi + 0x38]
cmp esi, dword [eax - 8]
jg 0x43eb21
mov dword [eax - 0xc], esi
mov eax, dword [edi + 0x38]
mov byte [esi + eax], 0
mov esi, dword [ebp - 0x64]
lea eax, [ebp - 0x18]
push eax
mov dl, byte [esi + 0x18]
mov ecx, esi
call fcn.0043dec0
add esp, 4
test eax, eax
jne 0x43e90d
mov edi, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x6c], ecx
mov eax, dword [edi + 0x3c]
mov edx, ecx
sub edx, eax
mov dword [ebp - 0x70], edx
mov esi, dword [eax - 0xc]
mov dword [ebp - 0x74], esi
mov eax, dword [ecx - 0xc]
test eax, eax
js 0x43eb21
push eax
push ecx
call fcn.00454da4
add esp, 8
mov ecx, eax
mov dword [ebp - 0x50], ecx
mov eax, SysReAllocString
sub eax, ecx
cmp eax, esi
jl 0x43eb21
add esi, ecx
js 0x43eb21
mov edx, dword [edi + 0x3c]
mov ecx, 1
sub ecx, dword [edx - 4]
mov eax, dword [edx - 8]
sub eax, esi
or eax, ecx
jge 0x43e8d1
push esi
lea ecx, [edi + 0x3c]
call fcn.00408cb5
mov edx, dword [edi + 0x3c]
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x70]
cmp ecx, eax
ja 0x43e8df
add ecx, edx
jmp 0x43e8e2
mov ecx, dword [ebp - 0x6c]
push dword [ebp - 0x50]
push ecx
lea ecx, [eax + edx]
mov edx, dword [ebp - 0x50]
call fcn.00409000
add esp, 8
mov eax, dword [edi + 0x3c]
cmp esi, dword [eax - 8]
jg 0x43eb21
mov dword [eax - 0xc], esi
mov eax, dword [edi + 0x3c]
mov byte [esi + eax], 0
mov esi, dword [ebp - 0x64]
lea eax, [ebp - 0x18]
push eax
mov dl, byte [esi + 0x19]
mov ecx, esi
call fcn.0043dec0
add esp, 4
mov esi, dword [ebp - 0x18]
test eax, eax
jne 0x43e9d7
mov eax, dword [ebp - 0x4c]
mov edx, dword [esi - 0xc]
mov ecx, esi
mov dword [ebp - 0x50], ecx
mov eax, dword [eax + 0x40]
sub ecx, eax
mov dword [ebp - 0x6c], ecx
mov edi, dword [eax - 0xc]
mov dword [ebp - 0x70], edi
test edx, edx
js 0x43eb21
push edx
push esi
call fcn.00454da4
add esp, 8
mov ecx, eax
mov dword [ebp - 0x40], ecx
mov eax, SysReAllocString
sub eax, ecx
cmp eax, edi
jl 0x43eb21
add edi, ecx
js 0x43eb21
mov edx, dword [ebp - 0x4c]
mov eax, dword [edx + 0x40]
mov dword [ebp - 0x74], eax
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or eax, ecx
jge 0x43e99b
push edi
lea ecx, [edx + 0x40]
call fcn.00408cb5
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ecx + 0x40]
jmp 0x43e99e
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x6c]
cmp edx, ecx
ja 0x43e9ad
add edx, eax
mov dword [ebp - 0x50], edx
mov edx, dword [ebp - 0x40]
push edx
push dword [ebp - 0x50]
add ecx, eax
call fcn.00409000
add esp, 8
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax + 0x40]
cmp edi, dword [ecx - 8]
jg 0x43eb21
mov dword [ecx - 0xc], edi
mov eax, dword [eax + 0x40]
mov byte [edi + eax], 0
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x43e9f8
mov ecx, dword [esi]
mov eax, dword [ecx]
push esi
mov eax, dword [eax + 4]
call eax
add byte [ebp - 0x68], 1
je 0x43ea27
mov edi, dword [ebp - 0x4c]
jmp 0x43e730
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x43ea27
mov ecx, dword [esi]
mov eax, dword [ecx]
push esi
mov eax, dword [eax + 4]
call eax
mov al, byte [ebp - 0x45]
cmp al, 2
ja 0x43ea3b
jne 0x43eac9
mov al, byte [ebp - 0x46]
cmp al, 1
jb 0x43ea76
push 1
lea eax, [ebp - 0x40]
push eax
push 0x16
mov edx, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x5c]
call fcn.0043e070
add esp, 0xc
test eax, eax
jne 0x43ea6a
mov eax, dword [ebp - 0x4c]
add eax, 0x44
push eax
mov ecx, dword [ebp - 0x40]
mov dl, byte [ecx + 7]
call fcn.0043dec0
add esp, 4
mov al, byte [ebp - 0x45]
cmp al, 2
ja 0x43ea7a
jne 0x43eac9
mov al, byte [ebp - 0x46]
cmp al, 3
jb 0x43eac9
push 1
lea eax, [ebp - 0x40]
push eax
push 0x27
mov edx, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x5c]
call fcn.0043e070
add esp, 0xc
mov edi, dword [ebp - 0x4c]
test eax, eax
jne 0x43eacc
lea eax, [edi + 0x48]
push eax
mov esi, dword [ebp - 0x40]
mov dl, byte [esi + 0xa]
mov ecx, esi
call fcn.0043dec0
lea eax, [edi + 0x4c]
push eax
mov dl, byte [esi + 8]
mov ecx, esi
call fcn.0043dec0
lea eax, [edi + 0x50]
push eax
mov dl, byte [esi + 9]
mov ecx, esi
call fcn.0043dec0
add esp, 0xc
jmp 0x43eacc
mov edi, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x78]
test eax, eax
je 0x43eada
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [ebp - 0x60]
push 0
call fcn.00454c63
push dword [ebp - 0x7c]
call fcn.00454c63
push dword [ebp - 0x80]
call fcn.00454c63
add esp, 0xc
mov dword [edi], esi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0044f515
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x4c]
mov esi, 0x490
jmp 0x43eadd
push 0x80070057
call fcn.004091c0
push 0x80004005
call fcn.004091c0
int3