Function at 0x40fbd0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x194
mov eax, dword [ebp + 8]
mov dword [ebp - 0x198], eax
mov eax, dword [0x442080]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x194], 0x3c7277d7
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x19c], eax
sub eax, 0x8333646f
je 0x410c93
jmp 0x40fc14
mov eax, dword [ebp - 0x19c]
sub eax, 0x87907a5a
je 0x410e55
jmp 0x40fc2a
mov eax, dword [ebp - 0x19c]
sub eax, 0xabd670be
je 0x410872
jmp 0x40fc40
mov eax, dword [ebp - 0x19c]
sub eax, 0xb0034a27
je 0x410ea9
jmp 0x40fc56
mov eax, dword [ebp - 0x19c]
sub eax, 0xba383647
je 0x410962
jmp 0x40fc6c
mov eax, dword [ebp - 0x19c]
sub eax, 0xc42a1184
je 0x41057c
jmp 0x40fc82
mov eax, dword [ebp - 0x19c]
sub eax, 0xc8932979
je 0x410195
jmp 0x40fc98
mov eax, dword [ebp - 0x19c]
sub eax, 0xce238dfb
je 0x41043e
jmp 0x40fcae
mov eax, dword [ebp - 0x19c]
sub eax, 0xcf6ef9e1
je 0x4102b9
jmp 0x40fcc4
mov eax, dword [ebp - 0x19c]
sub eax, 0xd5503356
je 0x41044d
jmp 0x40fcda
mov eax, dword [ebp - 0x19c]
sub eax, 0xd5ef2d6d
je 0x410717
jmp 0x40fcf0
mov eax, dword [ebp - 0x19c]
sub eax, 0xdce8609f
je 0x41024f
jmp 0x40fd06
mov eax, dword [ebp - 0x19c]
sub eax, 0xdf4551a1
je 0x4105e8
jmp 0x40fd1c
mov eax, dword [ebp - 0x19c]
sub eax, 0xe0a357d9
je 0x4104e0
jmp 0x40fd32
mov eax, dword [ebp - 0x19c]
sub eax, 0xe1b7c2b8
je 0x41014c
jmp 0x40fd48
mov eax, dword [ebp - 0x19c]
sub eax, 0xe2c8803e
je 0x410ba2
jmp 0x40fd5e
mov eax, dword [ebp - 0x19c]
sub eax, 0xe2cb8a38
je 0x410c05
jmp 0x40fd74
mov eax, dword [ebp - 0x19c]
sub eax, 0xe8ef31f5
je 0x410ce4
jmp 0x40fd8a
mov eax, dword [ebp - 0x19c]
sub eax, 0xea45adcc
je 0x411126
jmp 0x40fda0
mov eax, dword [ebp - 0x19c]
sub eax, 0xeb0cd854
je 0x410e46
jmp 0x40fdb6
mov eax, dword [ebp - 0x19c]
sub eax, 0xebf5eff3
je 0x410561
jmp 0x40fdcc
mov eax, dword [ebp - 0x19c]
sub eax, 0xf4563710
je 0x410327
jmp 0x40fde2
mov eax, dword [ebp - 0x19c]
sub eax, 0xfd6f5d6d
je 0x410e9a
jmp 0x40fdf8
mov eax, dword [ebp - 0x19c]
sub eax, 0xffac9687
je 0x410938
jmp 0x40fe0e
mov eax, dword [ebp - 0x19c]
sub eax, 0xffed7d1d
je 0x410995
jmp 0x40fe24
mov eax, dword [ebp - 0x19c]
sub eax, 0x4432450
je 0x4108c3
jmp 0x40fe3a
mov eax, dword [ebp - 0x19c]
sub eax, 0x58d85a0
je 0x4109f6
jmp 0x40fe50
mov eax, dword [ebp - 0x19c]
sub eax, 0x88e2611
je 0x410501
jmp 0x40fe66
mov eax, dword [ebp - 0x19c]
sub eax, 0x12bab60a
je 0x4105b8
jmp 0x40fe7c
mov eax, dword [ebp - 0x19c]
sub eax, 0x15e343e3
je 0x410cf3
jmp 0x40fe92
mov eax, dword [ebp - 0x19c]
sub eax, 0x187c08fe
je 0x410270
jmp 0x40fea8
mov eax, dword [ebp - 0x19c]
sub eax, 0x1b1ed1d5
je 0x410f2e
jmp 0x40febe
mov eax, dword [ebp - 0x19c]
sub eax, 0x1b706ca5
je 0x410f1f
jmp 0x40fed4
mov eax, dword [ebp - 0x19c]
sub eax, 0x21b1b6b3
je 0x410639
jmp 0x40feea
mov eax, dword [ebp - 0x19c]
sub eax, 0x2a5ddf17
je 0x410d39
jmp 0x40ff00
mov eax, dword [ebp - 0x19c]
sub eax, 0x2c30295a
je 0x410b93
jmp 0x40ff16
mov eax, dword [ebp - 0x19c]
sub eax, 0x2c5e7bfc
je 0x410a47
jmp 0x40ff2c
mov eax, dword [ebp - 0x19c]
sub eax, 0x315501a7
je 0x4108ef
jmp 0x40ff42
mov eax, dword [ebp - 0x19c]
sub eax, 0x322d099e
je 0x410804
jmp 0x40ff58
mov eax, dword [ebp - 0x19c]
sub eax, 0x32dc2165
je 0x41037f
jmp 0x40ff6e
mov eax, dword [ebp - 0x19c]
sub eax, 0x36886d54
je 0x410760
jmp 0x40ff84
mov eax, dword [ebp - 0x19c]
sub eax, 0x3c7277d7
je 0x41012b
jmp 0x40ff9a
mov eax, dword [ebp - 0x19c]
sub eax, 0x3d121f70
je 0x410d56
jmp 0x40ffb0
mov eax, dword [ebp - 0x19c]
sub eax, 0x3d1d4cc1
je 0x410c25
jmp 0x40ffc6
mov eax, dword [ebp - 0x19c]
sub eax, 0x3d5fbd1d
je 0x4107f5
jmp 0x40ffdc
mov eax, dword [ebp - 0x19c]
sub eax, 0x47bc0512
je 0x41102b
jmp 0x40fff2
mov eax, dword [ebp - 0x19c]
sub eax, 0x499c2863
je 0x410708
jmp 0x410008
mov eax, dword [ebp - 0x19c]
sub eax, 0x49f3cdcd
je 0x4105d9
jmp 0x41001e
mov eax, dword [ebp - 0x19c]
sub eax, 0x4bf4ef07
je 0x41059d
jmp 0x410034
mov eax, dword [ebp - 0x19c]
sub eax, 0x4e451a88
je 0x410336
jmp 0x41004a
mov eax, dword [ebp - 0x19c]
sub eax, 0x4e887228
je 0x410dcc
jmp 0x410060
mov eax, dword [ebp - 0x19c]
sub eax, 0x4f8ec384
je 0x411117
jmp 0x410076
mov eax, dword [ebp - 0x19c]
sub eax, 0x52cb0e02
je 0x410510
jmp 0x41008c
mov eax, dword [ebp - 0x19c]
sub eax, 0x616567e5
je 0x410f76
jmp 0x4100a2
mov eax, dword [ebp - 0x19c]
sub eax, 0x64da9531
je 0x410d10
jmp 0x4100b8
mov eax, dword [ebp - 0x19c]
sub eax, 0x6d35533a
je 0x4108d2
jmp 0x4100ce
mov eax, dword [ebp - 0x19c]
sub eax, 0x6d57e792
je 0x410fcb
jmp 0x4100e4
mov eax, dword [ebp - 0x19c]
sub eax, 0x6da7f1a2
je 0x41090e
jmp 0x4100fa
mov eax, dword [ebp - 0x19c]
sub eax, 0x701fe08e
je 0x41103a
jmp 0x410110
mov eax, dword [ebp - 0x19c]
sub eax, 0x7dbeab12
je 0x410eba
jmp 0x410126
jmp 0x411130
push eax
mov eax, esp
mov dword [ebp - 0x168], eax
push eax
mov eax, esp
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x194], 0xe1b7c2b8
jmp 0x411130
mov eax, dword [0x44354c]
mov ecx, dword [0x443548]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7dbeab12
mov ecx, 0xc8932979
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x411130
mov eax, dword [ebp - 0x198]
push eax
mov ecx, esp
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x16c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x170], eax
lea eax, [ebp - 0x11c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.0042ad20
add esp, 0xc
mov eax, dword [ebp - 0x16c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0
setne al
and al, 1
mov byte [ebp - 0x159], al
mov eax, dword [0x44354c]
mov ecx, dword [0x443548]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7dbeab12
mov ecx, 0xdce8609f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x411130
mov dl, byte [ebp - 0x159]
mov eax, 0x187c08fe
mov ecx, 0x4e451a88
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x411130
mov eax, dword [0x44354c]
mov ecx, dword [0x443548]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1b706ca5
mov ecx, 0xcf6ef9e1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x411130
mov ecx, dword [0x44354c]
mov eax, dword [0x443548]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1b706ca5
mov ecx, 0xf4563710
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x411130
mov dword [ebp - 0x194], 0xb0034a27
jmp 0x411130
mov eax, dword [0x44354c]
mov ecx, dword [0x443548]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1b1ed1d5
mov ecx, 0x32dc2165
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x411130
mov ecx, dword [ebp - 0x174]
mov edx, dword [ebp - 0x170]
lea eax, [ebp - 0x11c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x178], eax
lea eax, [ebp - 0x110]
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x154], eax
mov ecx, dword [0x44354c]
mov eax, dword [0x443548]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1b1ed1d5
mov ecx, 0xce238dfb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x411130
mov dword [ebp - 0x194], 0xd5503356
jmp 0x411130
mov eax, dword [ebp - 0x158]
mov ecx, dword [ebp - 0x154]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x110]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x17c], eax
mov eax, 0xffffffff
cmp dword [ebp - 0x17c], eax
sete al
and al, 1
mov byte [ebp - 0x14d], al
mov dword [ebp - 0x194], 0xe0a357d9
jmp 0x411130
mov dl, byte [ebp - 0x14d]
mov eax, 0x52cb0e02
mov ecx, 0x88e2611
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x411130
mov dword [ebp - 0x194], 0xb0034a27
jmp 0x411130
mov eax, dword [ebp - 0x17c]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x194], 0xebf5eff3
jmp 0x411130
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x194], 0xc42a1184
jmp 0x411130
mov edx, dword [ebp - 0x14c]
mov eax, 0x4bf4ef07
mov ecx, 0xdf4551a1
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x411130
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x194], 0x12bab60a
jmp 0x411130
mov eax, dword [ebp - 0x148]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x194], 0x49f3cdcd
jmp 0x411130
mov dword [ebp - 0x194], 0xb0034a27
jmp 0x411130
mov eax, dword [0x44354c]
mov ecx, dword [0x443548]
mov edx, eax
add edx, 0xd9aacb71
sub edx, 1
sub edx, 0xd9aacb71
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x616567e5
mov ecx, 0x21b1b6b3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x411130
mov eax, dword [ebp - 0x180]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x184], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x188]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x140], eax
mov ecx, dword [0x44354c]
mov eax, dword [0x443548]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x616567e5
mov ecx, 0x499c2863
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x411130
mov dword [ebp - 0x194], 0xd5ef2d6d
jmp 0x411130
mov eax, dword [0x44354c]
mov ecx, dword [0x443548]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6d57e792
mov ecx, 0x36886d54
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x411130
mov eax, dword [ebp - 0x144]
mov ecx, dword [ebp - 0x140]
sub eax, 0x22e19bdc
add eax, ecx
add eax, 0x22e19bdc
mov dword [ebp - 0x18c], eax
mov word [ebp - 0x18e], 0
mov ecx, dword [0x44354c]
mov eax, dword [0x443548]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6d57e792
mov ecx, 0x3d5fbd1d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x411130
mov dword [ebp - 0x194], 0x322d099e
jmp 0x411130
mov ecx, dword [0x44354c]
mov eax, dword [0x443548]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x47bc0512
mov ecx, 0xabd670be
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x411130
mov eax, dword [0x44354c]
mov ecx, dword [0x443548]
mov edx, eax
add edx, 0x312bf43a
sub edx, 1
sub edx, 0x312bf43a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x47bc0512
mov ecx, 0x4432450
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x411130
mov dword [ebp - 0x194], 0x6d35533a
jmp 0x411130
mov ax, word [ebp - 0x18e]
mov word [ebp - 0x13a], ax
mov dword [ebp - 0x194], 0x315501a7
jmp 0x411130
mov ax, word [ebp - 0x13a]
movzx eax, ax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x194], 0x6da7f1a2
jmp 0x411130
mov eax, dword [ebp - 0x18c]
movzx esi, word [eax + 6]
mov edx, dword [ebp - 0x138]
mov eax, 0x3d121f70
mov ecx, 0xffac9687
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x411130
mov eax, dword [ebp - 0x18c]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x18
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x194], 0xba383647
jmp 0x411130
mov eax, dword [ebp - 0x18c]
movzx edx, word [eax + 0x14]
mov eax, dword [ebp - 0x134]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x194], 0xffed7d1d
jmp 0x411130
mov ecx, dword [ebp - 0x130]
movzx eax, word [ebp - 0x18e]
imul edx, eax, 0x28
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x168]
mov dword [eax], ecx
mov eax, dword [ebp - 0x168]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x43afec
call fcn.0042e620
add esp, 8
mov edx, eax
mov eax, 0x58d85a0
mov ecx, 0x3d1d4cc1
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x411130
mov eax, dword [0x44354c]
mov ecx, dword [0x443548]
mov edx, eax
add edx, 0x96f6b50c
sub edx, 1
sub edx, 0x96f6b50c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x701fe08e
mov ecx, 0x2c5e7bfc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x411130
mov eax, dword [ebp - 0x164]
mov dword [eax], 0
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x178]
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, edx
xor edx, edx
sub edx, esi
add eax, edx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x164]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x160]
mov byte [eax], cl
mov ecx, dword [ebp - 0x178]
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov edx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor edx, edx
sub edx, eax
mov ecx, dword [ebp - 0x184]
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub ecx, 0x345c5290
add ecx, eax
add ecx, 0x345c5290
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0042ae80
add esp, 0xc
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
mov dword [ebp - 0x12c], eax
mov ecx, dword [0x44354c]
mov eax, dword [0x443548]
mov edx, ecx
add edx, 0x7afa5172
sub edx, 1
sub edx, 0x7afa5172
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x701fe08e
mov ecx, 0x2c30295a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x411130
mov dword [ebp - 0x194], 0xe2c8803e
jmp 0x411130
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov esi, dword [ebp - 0x178]
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
sub esi, eax
mov eax, dword [ebp - 0x164]
mov ecx, dword [ebp - 0x12c]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x125], al
mov dword [ebp - 0x194], 0xe2cb8a38
jmp 0x411130
mov cl, byte [ebp - 0x125]
and cl, 1
mov eax, dword [ebp - 0x160]
mov byte [eax], cl
mov dword [ebp - 0x194], 0x3d1d4cc1
jmp 0x411130
mov ecx, dword [0x44354c]
mov eax, dword [0x443548]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4f8ec384
mov ecx, 0x8333646f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x411130
mov eax, dword [0x44354c]
mov ecx, dword [0x443548]
mov edx, eax
sub edx, 0xc5715b4f
sub edx, 1
add edx, 0xc5715b4f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4f8ec384
mov ecx, 0xe8ef31f5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x411130
mov dword [ebp - 0x194], 0x15e343e3
jmp 0x411130
mov ax, word [ebp - 0x18e]
mov word [ebp - 0x124], ax
mov dword [ebp - 0x194], 0x64da9531
jmp 0x411130
mov ax, word [ebp - 0x124]
add ax, 0x9f47
add ax, 1
sub ax, 0x9f47
mov word [ebp - 0x122], ax
mov dword [ebp - 0x194], 0x2a5ddf17
jmp 0x411130
mov ax, word [ebp - 0x122]
mov word [ebp - 0x18e], ax
mov dword [ebp - 0x194], 0x6d35533a
jmp 0x411130
mov ecx, dword [0x44354c]
mov eax, dword [0x443548]
mov edx, ecx
add edx, 0x1808262f
sub edx, 1
sub edx, 0x1808262f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xea45adcc
mov ecx, 0x4e887228
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x411130
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x120], eax
mov ecx, dword [0x44354c]
mov eax, dword [0x443548]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xea45adcc
mov ecx, 0xeb0cd854
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x411130
mov dword [ebp - 0x194], 0x87907a5a
jmp 0x411130
mov eax, dword [ebp - 0x120]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x180]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x170]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x194], 0xfd6f5d6d
jmp 0x411130
mov dword [ebp - 0x194], 0xb0034a27
jmp 0x411130
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0042a030
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x16c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x170], eax
lea eax, [ebp - 0x11c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.0042ad20
add esp, 0xc
mov eax, dword [ebp - 0x16c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x194], 0xc8932979
jmp 0x411130
mov dword [ebp - 0x194], 0xcf6ef9e1
jmp 0x411130
mov ecx, dword [ebp - 0x174]
mov edx, dword [ebp - 0x170]
lea eax, [ebp - 0x11c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x194], 0x32dc2165
jmp 0x411130
mov eax, dword [ebp - 0x180]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x184], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x194], 0x21b1b6b3
jmp 0x411130
mov eax, dword [ebp - 0x144]
mov eax, dword [ebp - 0x140]
mov eax, dword [ebp - 0x140]
mov eax, dword [ebp - 0x144]
mov eax, dword [ebp - 0x140]
mov eax, dword [ebp - 0x144]
mov eax, dword [ebp - 0x140]
mov eax, dword [ebp - 0x144]
mov ecx, dword [ebp - 0x140]
sub eax, 0x1d89b831
add eax, ecx
add eax, 0x1d89b831
mov dword [ebp - 0x18c], eax
mov word [ebp - 0x18e], 0
mov dword [ebp - 0x194], 0x36886d54
jmp 0x411130
mov dword [ebp - 0x194], 0xabd670be
jmp 0x411130
mov eax, dword [ebp - 0x164]
mov dword [eax], 0
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x178]
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, edx
xor edx, edx
sub edx, esi
add eax, edx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x164]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x160]
mov byte [eax], cl
mov edx, dword [ebp - 0x178]
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add edx, 0x170ae421
add edx, eax
sub edx, 0x170ae421
mov ecx, dword [ebp - 0x184]
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add ecx, 0x5e173ad0
add ecx, eax
sub ecx, 0x5e173ad0
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0042ae80
add esp, 0xc
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x194], 0x2c5e7bfc
jmp 0x411130
mov dword [ebp - 0x194], 0x8333646f
jmp 0x411130
mov dword [ebp - 0x194], 0x4e887228
jmp 0x40fbf8