Function at 0x4121d0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1b8
mov eax, dword [ebp + 8]
mov eax, dword [0x444080]
xor eax, ebp
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x1a4], 0x212862a8
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x1a8], eax
sub eax, 0x80a5ba68
je 0x412b02
jmp 0x41221b
mov eax, dword [ebp - 0x1a8]
sub eax, 0x81eaf90f
je 0x412b23
jmp 0x412231
mov eax, dword [ebp - 0x1a8]
sub eax, 0x89fd9bd7
je 0x412db9
jmp 0x412247
mov eax, dword [ebp - 0x1a8]
sub eax, 0x8afa6daf
je 0x4132b3
jmp 0x41225d
mov eax, dword [ebp - 0x1a8]
sub eax, 0x93e672f7
je 0x413002
jmp 0x412273
mov eax, dword [ebp - 0x1a8]
sub eax, 0x97e6e02b
je 0x41311f
jmp 0x412289
mov eax, dword [ebp - 0x1a8]
sub eax, 0xa3483363
je 0x413511
jmp 0x41229f
mov eax, dword [ebp - 0x1a8]
sub eax, 0xa4285c5f
je 0x412e70
jmp 0x4122b5
mov eax, dword [ebp - 0x1a8]
sub eax, 0xa79106fd
je 0x41334b
jmp 0x4122cb
mov eax, dword [ebp - 0x1a8]
sub eax, 0xa9c260db
je 0x412edc
jmp 0x4122e1
mov eax, dword [ebp - 0x1a8]
sub eax, 0xb47b71f4
je 0x4132fa
jmp 0x4122f7
mov eax, dword [ebp - 0x1a8]
sub eax, 0xb72a5c98
je 0x41297b
jmp 0x41230d
mov eax, dword [ebp - 0x1a8]
sub eax, 0xc78fc277
je 0x4133db
jmp 0x412323
mov eax, dword [ebp - 0x1a8]
sub eax, 0xcdfc5ef0
je 0x41322f
jmp 0x412339
mov eax, dword [ebp - 0x1a8]
sub eax, 0xd416f5a1
je 0x4132eb
jmp 0x41234f
mov eax, dword [ebp - 0x1a8]
sub eax, 0xd578f8a2
je 0x4135bb
jmp 0x412365
mov eax, dword [ebp - 0x1a8]
sub eax, 0xdcae3acf
je 0x412c30
jmp 0x41237b
mov eax, dword [ebp - 0x1a8]
sub eax, 0xdcbdb68f
je 0x413613
jmp 0x412391
mov eax, dword [ebp - 0x1a8]
sub eax, 0xe1b9e6a7
je 0x412782
jmp 0x4123a7
mov eax, dword [ebp - 0x1a8]
sub eax, 0xe4ddeaf2
je 0x4128fe
jmp 0x4123bd
mov eax, dword [ebp - 0x1a8]
sub eax, 0xec6c3cdb
je 0x4134d8
jmp 0x4123d3
mov eax, dword [ebp - 0x1a8]
sub eax, 0xf174dede
je 0x413604
jmp 0x4123e9
mov eax, dword [ebp - 0x1a8]
sub eax, 0xf3a6bf9d
je 0x412d2a
jmp 0x4123ff
mov eax, dword [ebp - 0x1a8]
sub eax, 0xf4304864
je 0x4127bc
jmp 0x412415
mov eax, dword [ebp - 0x1a8]
sub eax, 0xf6c171fc
je 0x41290d
jmp 0x41242b
mov eax, dword [ebp - 0x1a8]
sub eax, 0xf73ac153
je 0x412c3f
jmp 0x412441
mov eax, dword [ebp - 0x1a8]
sub eax, 0x9908ef
je 0x412e02
jmp 0x412457
mov eax, dword [ebp - 0x1a8]
sub eax, 0x8472b22
je 0x412d39
jmp 0x41246d
mov eax, dword [ebp - 0x1a8]
sub eax, 0x879b3c5
je 0x413449
jmp 0x412483
mov eax, dword [ebp - 0x1a8]
sub eax, 0x98b98d2
je 0x412c4e
jmp 0x412499
mov eax, dword [ebp - 0x1a8]
sub eax, 0xb736856
je 0x412804
jmp 0x4124af
mov eax, dword [ebp - 0x1a8]
sub eax, 0xe56a385
je 0x412aa2
jmp 0x4124c5
mov eax, dword [ebp - 0x1a8]
sub eax, 0xfc1b3f6
je 0x412ecd
jmp 0x4124db
mov eax, dword [ebp - 0x1a8]
sub eax, 0x1b89a579
je 0x4132c2
jmp 0x4124f1
mov eax, dword [ebp - 0x1a8]
sub eax, 0x1fb5eec3
je 0x41359a
jmp 0x412507
mov eax, dword [ebp - 0x1a8]
sub eax, 0x209e1d2d
je 0x4134e7
jmp 0x41251d
mov eax, dword [ebp - 0x1a8]
sub eax, 0x212862a8
je 0x412732
jmp 0x412533
mov eax, dword [ebp - 0x1a8]
sub eax, 0x2b3fde06
je 0x4134c9
jmp 0x412549
mov eax, dword [ebp - 0x1a8]
sub eax, 0x2f3bee69
je 0x4136e7
jmp 0x41255f
mov eax, dword [ebp - 0x1a8]
sub eax, 0x378039b0
je 0x412a81
jmp 0x412575
mov eax, dword [ebp - 0x1a8]
sub eax, 0x42b0c15d
je 0x412b44
jmp 0x41258b
mov eax, dword [ebp - 0x1a8]
sub eax, 0x43c5849a
je 0x4127ad
jmp 0x4125a1
mov eax, dword [ebp - 0x1a8]
sub eax, 0x453a1813
je 0x413110
jmp 0x4125b7
mov eax, dword [ebp - 0x1a8]
sub eax, 0x4574f746
je 0x4136b4
jmp 0x4125cd
mov eax, dword [ebp - 0x1a8]
sub eax, 0x49181acd
je 0x412f26
jmp 0x4125e3
mov eax, dword [ebp - 0x1a8]
sub eax, 0x4ac0baa8
je 0x4136a5
jmp 0x4125f9
mov eax, dword [ebp - 0x1a8]
sub eax, 0x50e0cbe5
je 0x412d8d
jmp 0x41260f
mov eax, dword [ebp - 0x1a8]
sub eax, 0x51d7b5d2
je 0x412c9f
jmp 0x412625
mov eax, dword [ebp - 0x1a8]
sub eax, 0x53cb8a7d
je 0x412b5f
jmp 0x41263b
mov eax, dword [ebp - 0x1a8]
sub eax, 0x577d7a1d
je 0x412ba8
jmp 0x412651
mov eax, dword [ebp - 0x1a8]
sub eax, 0x58d45594
je 0x4133cc
jmp 0x412667
mov eax, dword [ebp - 0x1a8]
sub eax, 0x58f8a5d1
je 0x41287a
jmp 0x41267d
mov eax, dword [ebp - 0x1a8]
sub eax, 0x5ca7aa14
je 0x4131aa
jmp 0x412693
mov eax, dword [ebp - 0x1a8]
sub eax, 0x5ff4bc62
je 0x412de1
jmp 0x4126a9
mov eax, dword [ebp - 0x1a8]
sub eax, 0x606138af
je 0x412ab1
jmp 0x4126bf
mov eax, dword [ebp - 0x1a8]
sub eax, 0x6841f4d0
je 0x4131b9
jmp 0x4126d5
mov eax, dword [ebp - 0x1a8]
sub eax, 0x69847c7f
je 0x412d54
jmp 0x4126eb
mov eax, dword [ebp - 0x1a8]
sub eax, 0x6e90a168
je 0x412fb1
jmp 0x412701
mov eax, dword [ebp - 0x1a8]
sub eax, 0x70e08687
je 0x412f71
jmp 0x412717
mov eax, dword [ebp - 0x1a8]
sub eax, 0x77c7abfa
je 0x4134fc
jmp 0x41272d
jmp 0x413703
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x178], eax
lea eax, [ebp - 0x120]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.0042dcc0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub esp, 4
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x1a4], 0xe1b9e6a7
jmp 0x413703
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x17c], eax
mov eax, 0x43c5849a
mov ecx, 0xf4304864
cmp dword [ebp - 0x17c], 0
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x413703
mov dword [ebp - 0x1a4], 0x209e1d2d
jmp 0x413703
mov ecx, dword [ebp - 0x17c]
mov edx, dword [ebp - 0x178]
lea eax, [ebp - 0x120]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
sub esp, 0x10
lea eax, [ebp - 0x120]
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x1a4], 0xb736856
jmp 0x413703
mov ecx, dword [0x44553c]
mov eax, dword [0x445538]
mov edx, ecx
sub edx, 0xa9fbc42e
sub edx, 1
add edx, 0xa9fbc42e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x77c7abfa
mov ecx, 0x58f8a5d1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x413703
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov dword [ebp - 0x168], eax
mov ecx, dword [0x44553c]
mov eax, dword [0x445538]
mov edx, ecx
add edx, 0xcfdad246
sub edx, 1
sub edx, 0xcfdad246
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x77c7abfa
mov ecx, 0xe4ddeaf2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x413703
mov dword [ebp - 0x1a4], 0xf6c171fc
jmp 0x413703
mov ecx, dword [0x44553c]
mov eax, dword [0x445538]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa3483363
mov ecx, 0xb72a5c98
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x413703
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x180], eax
lea eax, [ebp - 0x114]
mov ecx, dword [ebp - 0x17c]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
sub esp, 0xc
lea eax, [ebp - 0x114]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
mov dword [ebp - 0x184], eax
mov eax, 0xffffffff
cmp dword [ebp - 0x184], eax
sete al
and al, 1
mov byte [ebp - 0x162], al
mov ecx, dword [0x44553c]
mov eax, dword [0x445538]
mov edx, ecx
sub edx, 0x7fdd700f
sub edx, 1
add edx, 0x7fdd700f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa3483363
mov ecx, 0x378039b0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x413703
mov dl, byte [ebp - 0x162]
mov eax, 0x606138af
mov ecx, 0xe56a385
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x413703
mov dword [ebp - 0x1a4], 0x209e1d2d
jmp 0x413703
mov eax, dword [ebp - 0x184]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
sub esp, 0x18
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x1a4], 0x80a5ba68
jmp 0x413703
cmp dword [ebp - 0x188], 0
setne al
and al, 1
mov byte [ebp - 0x161], al
mov dword [ebp - 0x1a4], 0x81eaf90f
jmp 0x413703
mov dl, byte [ebp - 0x161]
mov eax, 0x42b0c15d
mov ecx, 0x98b98d2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x413703
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x1a4], 0x53cb8a7d
jmp 0x413703
mov eax, dword [0x44553c]
mov ecx, dword [0x445538]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1fb5eec3
mov ecx, 0x577d7a1d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x413703
mov eax, dword [ebp - 0x160]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov ecx, dword [0x44553c]
mov eax, dword [0x445538]
mov edx, ecx
add edx, 0x62795461
sub edx, 1
sub edx, 0x62795461
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1fb5eec3
mov ecx, 0xdcae3acf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x413703
mov dword [ebp - 0x1a4], 0xf73ac153
jmp 0x413703
mov dword [ebp - 0x1a4], 0x209e1d2d
jmp 0x413703
mov eax, dword [0x44553c]
mov ecx, dword [0x445538]
mov edx, eax
add edx, 0x9dc8694d
sub edx, 1
sub edx, 0x9dc8694d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd578f8a2
mov ecx, 0x51d7b5d2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x413703
mov eax, dword [ebp - 0x188]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
sub esp, 0x14
mov dword [ebp - 0x18c], eax
mov eax, dword [0x44553c]
mov ecx, dword [0x445538]
mov edx, eax
sub edx, 0x6c8d0e23
sub edx, 1
add edx, 0x6c8d0e23
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd578f8a2
mov ecx, 0xf3a6bf9d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x413703
mov dword [ebp - 0x1a4], 0x8472b22
jmp 0x413703
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x1a4], 0x69847c7f
jmp 0x413703
mov eax, dword [ebp - 0x180]
mov ecx, dword [ebp - 0x190]
mov ecx, dword [ecx + 0x3c]
sub eax, 0xc6e7659b
add eax, ecx
add eax, 0xc6e7659b
mov dword [ebp - 0x194], eax
mov word [ebp - 0x196], 0
mov dword [ebp - 0x1a4], 0x50e0cbe5
jmp 0x413703
movzx eax, word [ebp - 0x196]
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x194]
movzx eax, word [eax + 6]
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x1a4], 0x89fd9bd7
jmp 0x413703
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x158]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x151], al
mov dword [ebp - 0x1a4], 0x5ff4bc62
jmp 0x413703
mov dl, byte [ebp - 0x151]
mov eax, 0xb47b71f4
mov ecx, 0x9908ef
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x413703
mov ecx, dword [0x44553c]
mov eax, dword [0x445538]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf174dede
mov ecx, 0xa4285c5f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x413703
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x150], eax
mov eax, dword [0x44553c]
mov ecx, dword [0x445538]
mov edx, eax
sub edx, 0xac786bd4
sub edx, 1
add edx, 0xac786bd4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf174dede
mov ecx, 0xfc1b3f6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x413703
mov dword [ebp - 0x1a4], 0xa9c260db
jmp 0x413703
mov eax, dword [ebp - 0x150]
xor ecx, ecx
sub ecx, 0x18
sub eax, ecx
mov ecx, dword [ebp - 0x194]
movzx edx, word [ecx + 0x14]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x14c], eax
movzx eax, word [ebp - 0x196]
imul eax, eax, 0x28
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x1a4], 0x49181acd
jmp 0x413703
mov eax, dword [ebp - 0x14c]
mov edx, dword [ebp - 0x148]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x19c], eax
mov ecx, dword [ebp - 0x19c]
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x43d1e3
call fcn.004315c0
mov edx, eax
mov eax, 0x70e08687
mov ecx, 0x5ca7aa14
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x413703
mov dword [ebp - 0x124], 0
mov eax, dword [ebp - 0x19c]
mov eax, dword [eax + 8]
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x1a4], 0x6e90a168
jmp 0x413703
mov eax, dword [0x44553c]
mov ecx, dword [0x445538]
mov edx, eax
add edx, 0xc492c4d6
sub edx, 1
sub edx, 0xc492c4d6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdcbdb68f
mov ecx, 0x93e672f7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x413703
mov eax, dword [ebp - 0x13c]
mov edx, dword [eax + 0xc]
mov ecx, dword [ebp - 0x140]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor edx, edx
sub edx, eax
mov ecx, dword [ebp - 0x144]
lea eax, [ebp - 0x124]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x19d], al
mov eax, dword [ebp - 0x180]
mov ecx, dword [ebp - 0x19c]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x18c]
mov ecx, dword [ebp - 0x19c]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x19c]
add eax, 8
mov dword [ebp - 0x130], eax
mov ecx, dword [0x44553c]
mov eax, dword [0x445538]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xdcbdb68f
mov ecx, 0x453a1813
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x413703
mov dword [ebp - 0x1a4], 0x97e6e02b
jmp 0x413703
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
mov edx, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x134]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0042de20
mov ecx, dword [ebp - 0x124]
mov eax, dword [ebp - 0x19c]
mov edx, dword [eax + 8]
mov esi, dword [ebp - 0x180]
mov eax, dword [ebp - 0x19c]
mov edi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
xor esi, esi
sub esi, edi
add eax, esi
xor esi, esi
sub esi, eax
lea eax, [ebp - 0x124]
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x19d], al
mov dword [ebp - 0x1a4], 0x5ca7aa14
jmp 0x413703
mov dword [ebp - 0x1a4], 0x6841f4d0
jmp 0x413703
mov ecx, dword [0x44553c]
mov eax, dword [0x445538]
mov edx, ecx
add edx, 0x9ea06ce8
sub edx, 1
sub edx, 0x9ea06ce8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4ac0baa8
mov ecx, 0xcdfc5ef0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x413703
mov ax, word [ebp - 0x196]
mov word [ebp - 0x12a], ax
mov ecx, dword [0x44553c]
mov eax, dword [0x445538]
mov edx, ecx
sub edx, 0xfa153edb
sub edx, 1
add edx, 0xfa153edb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4ac0baa8
mov ecx, 0x8afa6daf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x413703
mov dword [ebp - 0x1a4], 0x1b89a579
jmp 0x413703
mov ax, word [ebp - 0x12a]
add ax, 0x2f0
add ax, 1
sub ax, 0x2f0
mov word [ebp - 0x196], ax
mov dword [ebp - 0x1a4], 0xd416f5a1
jmp 0x413703
mov dword [ebp - 0x1a4], 0x50e0cbe5
jmp 0x413703
mov eax, dword [0x44553c]
mov ecx, dword [0x445538]
mov edx, eax
add edx, 0x8e1b0542
sub edx, 1
sub edx, 0x8e1b0542
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4574f746
mov ecx, 0xa79106fd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x413703
mov eax, dword [ebp - 0x184]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x188]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x128], eax
mov eax, dword [0x44553c]
mov ecx, dword [0x445538]
mov edx, eax
sub edx, 0xc896d1ce
sub edx, 1
add edx, 0xc896d1ce
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4574f746
mov ecx, 0x58d45594
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x413703
mov dword [ebp - 0x1a4], 0xc78fc277
jmp 0x413703
mov ecx, dword [0x44553c]
mov eax, dword [0x445538]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2f3bee69
mov ecx, 0x879b3c5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x413703
mov eax, dword [ebp - 0x128]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov ecx, dword [0x44553c]
mov eax, dword [0x445538]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2f3bee69
mov ecx, 0x2b3fde06
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1a4], eax
jmp 0x413703
mov dword [ebp - 0x1a4], 0xec6c3cdb
jmp 0x413703
mov dword [ebp - 0x1a4], 0x209e1d2d
jmp 0x413703
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042cfd0
add esp, 0x1b8
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x1a4], 0x58f8a5d1
jmp 0x413703
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x180], eax
lea eax, [ebp - 0x114]
mov ecx, dword [ebp - 0x17c]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
sub esp, 0xc
lea eax, [ebp - 0x114]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x1a4], 0xb72a5c98
jmp 0x413703
mov eax, dword [ebp - 0x160]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x1a4], 0x577d7a1d
jmp 0x413703
mov eax, dword [ebp - 0x188]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
sub esp, 0x14
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x1a4], 0x51d7b5d2
jmp 0x413703
mov dword [ebp - 0x1a4], 0xa4285c5f
jmp 0x413703
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x140]
mov ecx, dword [ebp - 0x140]
mov ecx, dword [ebp - 0x140]
mov ecx, dword [ebp - 0x140]
mov ecx, dword [ebp - 0x140]
mov ecx, dword [ebp - 0x140]
mov ecx, dword [ebp - 0x140]
mov ecx, dword [ebp - 0x140]
mov edx, dword [ebp - 0x140]
add edx, 0x587a2fce
add edx, eax
sub edx, 0x587a2fce
mov ecx, dword [ebp - 0x144]
lea eax, [ebp - 0x124]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x19d], al
mov dword [ebp - 0x1a4], 0x93e672f7
jmp 0x413703
mov dword [ebp - 0x1a4], 0xcdfc5ef0
jmp 0x413703
mov eax, dword [ebp - 0x184]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x188]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x1a4], 0xa79106fd
jmp 0x413703
mov eax, dword [ebp - 0x128]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x1a4], 0x879b3c5
jmp 0x4121ff