Function at 0x40d7f0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x70
mov eax, dword [0x4e0080]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov ecx, dword [0x4e1564]
mov eax, dword [0x4e1560]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x6e], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x6d], al
mov dword [ebp - 0x74], 0x5d71858c
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x78], eax
sub eax, 0x9315c598
je 0x40e4f3
jmp 0x40d850
mov eax, dword [ebp - 0x78]
sub eax, 0x950f6ebb
je 0x40e2b1
jmp 0x40d863
mov eax, dword [ebp - 0x78]
sub eax, 0x962a8cf6
je 0x40e310
jmp 0x40d876
mov eax, dword [ebp - 0x78]
sub eax, 0x98fb02e4
je 0x40df3f
jmp 0x40d889
mov eax, dword [ebp - 0x78]
sub eax, 0x9ba2ebea
je 0x40e04c
jmp 0x40d89c
mov eax, dword [ebp - 0x78]
sub eax, 0xa12d05a0
je 0x40ded9
jmp 0x40d8af
mov eax, dword [ebp - 0x78]
sub eax, 0xb31cbb23
je 0x40e4dd
jmp 0x40d8c2
mov eax, dword [ebp - 0x78]
sub eax, 0xb624c179
je 0x40e2eb
jmp 0x40d8d5
mov eax, dword [ebp - 0x78]
sub eax, 0xb857304c
je 0x40e3f1
jmp 0x40d8e8
mov eax, dword [ebp - 0x78]
sub eax, 0xbeee9edd
je 0x40dbde
jmp 0x40d8fb
mov eax, dword [ebp - 0x78]
sub eax, 0xc3feb3f8
je 0x40e1b4
jmp 0x40d90e
mov eax, dword [ebp - 0x78]
sub eax, 0xca9c44cb
je 0x40dfbf
jmp 0x40d921
mov eax, dword [ebp - 0x78]
sub eax, 0xcc007975
je 0x40dbd2
jmp 0x40d934
mov eax, dword [ebp - 0x78]
sub eax, 0xd513bf18
je 0x40e3fd
jmp 0x40d947
mov eax, dword [ebp - 0x78]
sub eax, 0xd5777464
je 0x40e1c0
jmp 0x40d95a
mov eax, dword [ebp - 0x78]
sub eax, 0xded253a5
je 0x40df33
jmp 0x40d96d
mov eax, dword [ebp - 0x78]
sub eax, 0xdf8d4666
je 0x40e35e
jmp 0x40d980
mov eax, dword [ebp - 0x78]
sub eax, 0xe432b2bc
je 0x40df5a
jmp 0x40d993
mov eax, dword [ebp - 0x78]
sub eax, 0xa56f118
je 0x40e1d6
jmp 0x40d9a6
mov eax, dword [ebp - 0x78]
sub eax, 0xc4a66c7
je 0x40dda7
jmp 0x40d9b9
mov eax, dword [ebp - 0x78]
sub eax, 0x1659960d
je 0x40dd61
jmp 0x40d9cc
mov eax, dword [ebp - 0x78]
sub eax, 0x171babdf
je 0x40e2bd
jmp 0x40d9df
mov eax, dword [ebp - 0x78]
sub eax, 0x177aafb6
je 0x40e087
jmp 0x40d9f2
mov eax, dword [ebp - 0x78]
sub eax, 0x18cb6e5a
je 0x40e444
jmp 0x40da05
mov eax, dword [ebp - 0x78]
sub eax, 0x20a21cb7
je 0x40e3e0
jmp 0x40da18
mov eax, dword [ebp - 0x78]
sub eax, 0x24a962b0
je 0x40de3d
jmp 0x40da2b
mov eax, dword [ebp - 0x78]
sub eax, 0x2530db84
je 0x40e23c
jmp 0x40da3e
mov eax, dword [ebp - 0x78]
sub eax, 0x2b7df224
je 0x40de49
jmp 0x40da51
mov eax, dword [ebp - 0x78]
sub eax, 0x38de8d9d
je 0x40de66
jmp 0x40da64
mov eax, dword [ebp - 0x78]
sub eax, 0x4dbebbcb
je 0x40e0d5
jmp 0x40da77
mov eax, dword [ebp - 0x78]
sub eax, 0x54105c0b
je 0x40e1a8
jmp 0x40da8a
mov eax, dword [ebp - 0x78]
sub eax, 0x55d90e5e
je 0x40e1f6
jmp 0x40da9d
mov eax, dword [ebp - 0x78]
sub eax, 0x5d71858c
je 0x40db01
jmp 0x40dab0
mov eax, dword [ebp - 0x78]
sub eax, 0x63d84569
je 0x40e432
jmp 0x40dac3
mov eax, dword [ebp - 0x78]
sub eax, 0x6e5ad70c
je 0x40df6e
jmp 0x40dad6
mov eax, dword [ebp - 0x78]
sub eax, 0x7da27ae8
je 0x40db4c
jmp 0x40dae9
mov eax, dword [ebp - 0x78]
sub eax, 0x7ea37365
je 0x40dff2
jmp 0x40dafc
jmp 0x40e509
mov bl, byte [ebp - 0x6e]
mov dh, byte [ebp - 0x6d]
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb857304c
mov ecx, 0x7da27ae8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x40e509
push eax
mov eax, esp
mov dword [ebp - 0x6c], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x68], eax
push eax
mov eax, esp
mov dword [ebp - 0x64], eax
push eax
mov eax, esp
mov dword [ebp - 0x60], eax
push eax
mov eax, esp
mov dword [ebp - 0x5c], eax
push eax
mov eax, esp
mov dword [ebp - 0x58], eax
push eax
mov eax, esp
mov dword [ebp - 0x54], eax
push eax
mov eax, esp
mov dword [ebp - 0x50], eax
push eax
mov eax, esp
mov dword [ebp - 0x4c], eax
mov eax, dword [0x4e1564]
mov ecx, dword [0x4e1560]
mov edx, eax
add edx, 0x98cf24d9
sub edx, 1
sub edx, 0x98cf24d9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb857304c
mov ecx, 0xcc007975
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x40e509
mov dword [ebp - 0x74], 0xbeee9edd
jmp 0x40e509
push eax
mov eax, esp
mov dword [ebp - 0x48], eax
push eax
mov eax, esp
mov dword [ebp - 0x44], eax
push eax
mov eax, esp
mov dword [ebp - 0x40], eax
push eax
mov eax, esp
mov dword [ebp - 0x3c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.0041e010
add esp, 0xc
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x64]
mov dword [eax], ecx
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x68]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x60]
mov dword [eax], ecx
lea eax, str.c:windows_system32_ntdll.dll
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x5c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x58]
mov dword [eax], ecx
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x54]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x50]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
add eax, 0x3c
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x74], 0x1659960d
jmp 0x40e509
mov eax, dword [0x4e1564]
mov ecx, dword [0x4e1560]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd513bf18
mov ecx, 0xc4a66c7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x40e509
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x38]
add ecx, 0x79b1ccb4
add ecx, eax
sub ecx, 0x79b1ccb4
mov eax, dword [ebp - 0x4c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x48]
mov word [eax], 0
mov ecx, dword [0x4e1564]
mov eax, dword [0x4e1560]
mov edx, ecx
add edx, 0x33a01959
sub edx, 1
sub edx, 0x33a01959
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd513bf18
mov ecx, 0x24a962b0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x40e509
mov dword [ebp - 0x74], 0x2b7df224
jmp 0x40e509
mov eax, dword [ebp - 0x48]
movzx eax, word [eax]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x74], 0x38de8d9d
jmp 0x40e509
mov ecx, dword [0x4e1564]
mov eax, dword [0x4e1560]
mov edx, ecx
sub edx, 0x8a47644c
sub edx, 1
add edx, 0x8a47644c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x63d84569
mov ecx, 0xa12d05a0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x40e509
mov eax, dword [ebp - 0x2c]
movzx ecx, word [eax + 6]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x25], al
mov eax, dword [0x4e1564]
mov ecx, dword [0x4e1560]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x63d84569
mov ecx, 0xded253a5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x40e509
mov dword [ebp - 0x74], 0x98fb02e4
jmp 0x40e509
mov dl, byte [ebp - 0x25]
mov eax, 0x171babdf
mov ecx, 0xe432b2bc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x40e509
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x74], 0x6e5ad70c
jmp 0x40e509
mov ecx, dword [ebp - 0x24]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 0x18
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
movzx edx, word [eax + 0x14]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x48]
movzx eax, word [eax]
imul edx, eax, 0x28
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x44]
mov dword [eax], ecx
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x74], 0xca9c44cb
jmp 0x40e509
mov ecx, dword [ebp - 0x20]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x42cd4d
call fcn.00421910
add esp, 8
mov edx, eax
mov eax, 0x7ea37365
mov ecx, 0xc3feb3f8
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x40e509
mov eax, dword [ebp - 0x40]
mov dword [eax], 0
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x60]
mov edx, dword [eax]
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, edx
xor edx, edx
sub edx, esi
add eax, edx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x40]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x74], 0x9ba2ebea
jmp 0x40e509
mov eax, dword [ebp - 0x1c]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x3c]
mov byte [eax], cl
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x74], 0x177aafb6
jmp 0x40e509
mov eax, dword [0x4e1564]
mov ecx, dword [0x4e1560]
mov edx, eax
sub edx, 0xefcb425a
sub edx, 1
add edx, 0xefcb425a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x18cb6e5a
mov ecx, 0x4dbebbcb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x40e509
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x54]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub ecx, eax
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0041e170
add esp, 0xc
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x60]
mov esi, dword [eax]
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub esi, 0x93244ae5
add esi, eax
add esi, 0x93244ae5
mov eax, dword [ebp - 0x40]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x3c]
mov byte [eax], cl
mov eax, dword [0x4e1564]
mov ecx, dword [0x4e1560]
mov edx, eax
add edx, 0x1cdff392
sub edx, 1
sub edx, 0x1cdff392
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x18cb6e5a
mov ecx, 0x54105c0b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x40e509
mov dword [ebp - 0x74], 0xc3feb3f8
jmp 0x40e509
mov dword [ebp - 0x74], 0xd5777464
jmp 0x40e509
mov eax, dword [ebp - 0x48]
mov ax, word [eax]
mov word [ebp - 0x14], ax
mov dword [ebp - 0x74], 0xa56f118
jmp 0x40e509
mov ax, word [ebp - 0x14]
add ax, 0xd0c2
add ax, 1
sub ax, 0xd0c2
mov word [ebp - 0x12], ax
mov dword [ebp - 0x74], 0x55d90e5e
jmp 0x40e509
mov eax, dword [0x4e1564]
mov ecx, dword [0x4e1560]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb31cbb23
mov ecx, 0x2530db84
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x40e509
mov eax, dword [ebp - 0x48]
mov cx, word [ebp - 0x12]
mov word [eax], cx
mov ecx, dword [0x4e1564]
mov eax, dword [0x4e1560]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb31cbb23
mov ecx, 0x950f6ebb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x40e509
mov dword [ebp - 0x74], 0x2b7df224
jmp 0x40e509
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x74], 0xb624c179
jmp 0x40e509
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x74], 0x962a8cf6
jmp 0x40e509
mov eax, dword [0x4e1564]
mov ecx, dword [0x4e1560]
mov edx, eax
sub edx, 0x883d3776
sub edx, 1
add edx, 0x883d3776
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9315c598
mov ecx, 0xdf8d4666
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x40e509
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [0x4e1564]
mov eax, dword [0x4e1560]
mov edx, ecx
sub edx, 0xa6a8abd4
sub edx, 1
add edx, 0xa6a8abd4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9315c598
mov ecx, 0x20a21cb7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x40e509
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0041d300
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov dword [ebp - 0x74], 0x7da27ae8
jmp 0x40e509
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
add ecx, 0x4e4dc10c
add ecx, eax
sub ecx, 0x4e4dc10c
mov eax, dword [ebp - 0x4c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x48]
mov word [eax], 0
mov dword [ebp - 0x74], 0xc4a66c7
jmp 0x40e509
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x74], 0xa12d05a0
jmp 0x40e509
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x54]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub ecx, 0x5daf23ca
add ecx, eax
add ecx, 0x5daf23ca
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0041e170
add esp, 0xc
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x60]
mov esi, dword [eax]
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add esi, 0xa732b222
add esi, eax
sub esi, 0xa732b222
mov eax, dword [ebp - 0x40]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x3c]
mov byte [eax], cl
mov dword [ebp - 0x74], 0x4dbebbcb
jmp 0x40e509
mov eax, dword [ebp - 0x48]
mov cx, word [ebp - 0x12]
mov word [eax], cx
mov dword [ebp - 0x74], 0x2530db84
jmp 0x40e509
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x74], 0xdf8d4666
jmp 0x40d83a