Function at 0x40f690
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x84
mov eax, dword [0x4f0880]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov ecx, dword [0x4f1d54]
mov eax, dword [0x4f1d50]
mov edx, ecx
add edx, 0xf3c43e4
sub edx, 1
sub edx, 0xf3c43e4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x76], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x75], al
mov dword [ebp - 0x7c], 0x5c2fe683
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x80], eax
sub eax, 0x818600da
je 0x41009b
jmp 0x40f6fb
mov eax, dword [ebp - 0x80]
sub eax, 0x86cece51
je 0x410141
jmp 0x40f70e
mov eax, dword [ebp - 0x80]
sub eax, 0x9adb117e
je 0x40fcac
jmp 0x40f721
mov eax, dword [ebp - 0x80]
sub eax, 0x9e07f081
je 0x40fe4a
jmp 0x40f734
mov eax, dword [ebp - 0x80]
sub eax, 0xb3c34ff5
je 0x40fb7d
jmp 0x40f747
mov eax, dword [ebp - 0x80]
sub eax, 0xb74e62a1
je 0x40fd58
jmp 0x40f75a
mov eax, dword [ebp - 0x80]
sub eax, 0xc5d583a6
je 0x40fe0e
jmp 0x40f76d
mov eax, dword [ebp - 0x80]
sub eax, 0xc68c9f37
je 0x40faa0
jmp 0x40f780
mov eax, dword [ebp - 0x80]
sub eax, 0xd04eb5dc
je 0x40fd94
jmp 0x40f793
mov eax, dword [ebp - 0x80]
sub eax, 0xd856390c
je 0x40ff50
jmp 0x40f7a6
mov eax, dword [ebp - 0x80]
sub eax, 0xdfa6e822
je 0x40f985
jmp 0x40f7b9
mov eax, dword [ebp - 0x80]
sub eax, 0xe359a3e4
je 0x40fc97
jmp 0x40f7cc
mov eax, dword [ebp - 0x80]
sub eax, 0xe736efd7
je 0x410165
jmp 0x40f7df
mov eax, dword [ebp - 0x80]
sub eax, 0xee7d1a01
je 0x40fa94
jmp 0x40f7f2
mov eax, dword [ebp - 0x80]
sub eax, 0xff055a07
je 0x40ff44
jmp 0x40f805
mov eax, dword [ebp - 0x80]
sub eax, 0x156909d4
je 0x40fc2e
jmp 0x40f818
mov eax, dword [ebp - 0x80]
sub eax, 0x161c508a
je 0x40fcfa
jmp 0x40f82b
mov eax, dword [ebp - 0x80]
sub eax, 0x1816080c
je 0x40fd73
jmp 0x40f83e
mov eax, dword [ebp - 0x80]
sub eax, 0x22f9677d
je 0x40fffa
jmp 0x40f851
mov eax, dword [ebp - 0x80]
sub eax, 0x287af96c
je 0x410028
jmp 0x40f864
mov eax, dword [ebp - 0x80]
sub eax, 0x2955b954
je 0x410006
jmp 0x40f877
mov eax, dword [ebp - 0x80]
sub eax, 0x33b05074
je 0x40fdad
jmp 0x40f88a
mov eax, dword [ebp - 0x80]
sub eax, 0x391a3a93
je 0x40ff96
jmp 0x40f89d
mov eax, dword [ebp - 0x80]
sub eax, 0x4e622b85
je 0x40fc8b
jmp 0x40f8b0
mov eax, dword [ebp - 0x80]
sub eax, 0x5c2fe683
je 0x40f93a
jmp 0x40f8c3
mov eax, dword [ebp - 0x80]
sub eax, 0x5c37f700
je 0x41007b
jmp 0x40f8d6
mov eax, dword [ebp - 0x80]
sub eax, 0x618c5201
je 0x40feb2
jmp 0x40f8e9
mov eax, dword [ebp - 0x80]
sub eax, 0x64d04a14
je 0x41001c
jmp 0x40f8fc
mov eax, dword [ebp - 0x80]
sub eax, 0x6bab271b
je 0x410067
jmp 0x40f90f
mov eax, dword [ebp - 0x80]
sub eax, 0x6cf5c775
je 0x40fbbb
jmp 0x40f922
mov eax, dword [ebp - 0x80]
sub eax, 0x798f6aa1
je 0x410153
jmp 0x40f935
jmp 0x41016f
mov bl, byte [ebp - 0x76]
mov dh, byte [ebp - 0x75]
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x818600da
mov ecx, 0xdfa6e822
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x41016f
push eax
mov eax, esp
mov dword [ebp - 0x74], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x70], eax
push eax
mov eax, esp
mov dword [ebp - 0x6c], eax
push eax
mov eax, esp
mov dword [ebp - 0x68], eax
push eax
mov eax, esp
mov dword [ebp - 0x64], eax
push eax
mov eax, esp
mov dword [ebp - 0x60], eax
push eax
mov eax, esp
mov dword [ebp - 0x5c], eax
push eax
mov eax, esp
mov dword [ebp - 0x58], eax
push eax
mov eax, esp
mov dword [ebp - 0x54], eax
push eax
mov eax, esp
mov dword [ebp - 0x50], eax
push eax
mov eax, esp
mov dword [ebp - 0x4c], eax
push eax
mov eax, esp
mov dword [ebp - 0x48], eax
push eax
mov eax, esp
mov dword [ebp - 0x44], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.0041f6c0
add esp, 0xc
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x74]
mov edx, dword [eax]
mov eax, dword [ebp - 0x70]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [0x4f1d54]
mov ecx, dword [0x4f1d50]
mov edx, eax
add edx, 0xf98bd0e5
sub edx, 1
sub edx, 0xf98bd0e5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x818600da
mov ecx, 0xee7d1a01
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x41016f
mov dword [ebp - 0x7c], 0xc68c9f37
jmp 0x41016f
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x68]
mov dword [eax], ecx
lea eax, str.c:windows_system32_ntdll.dll
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x64]
mov dword [eax], ecx
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x60]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x5c]
mov dword [eax], ecx
mov dword [ebp - 0x7c], 0xb3c34ff5
jmp 0x41016f
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x58]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
sub ecx, 0x94e706bd
add ecx, eax
add ecx, 0x94e706bd
mov eax, dword [ebp - 0x54]
mov dword [eax], ecx
mov eax, dword [ebp - 0x50]
mov word [eax], 0
mov dword [ebp - 0x7c], 0x6cf5c775
jmp 0x41016f
mov ecx, dword [0x4f1d54]
mov eax, dword [0x4f1d50]
mov edx, ecx
add edx, 0x4c38e00f
sub edx, 1
sub edx, 0x4c38e00f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x86cece51
mov ecx, 0x156909d4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x41016f
mov eax, dword [ebp - 0x50]
movzx eax, word [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
add eax, 4
add eax, 2
mov dword [ebp - 0x3c], eax
mov eax, dword [0x4f1d54]
mov ecx, dword [0x4f1d50]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x86cece51
mov ecx, 0x4e622b85
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x41016f
mov dword [ebp - 0x7c], 0xe359a3e4
jmp 0x41016f
mov eax, dword [ebp - 0x3c]
movzx eax, word [eax]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x7c], 0x9adb117e
jmp 0x41016f
mov eax, dword [0x4f1d54]
mov ecx, dword [0x4f1d50]
mov edx, eax
add edx, 0xa382b81a
sub edx, 1
sub edx, 0xa382b81a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x798f6aa1
mov ecx, 0x161c508a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x41016f
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x38]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x31], al
mov eax, dword [0x4f1d54]
mov ecx, dword [0x4f1d50]
mov edx, eax
sub edx, 0x3055ba31
sub edx, 1
add edx, 0x3055ba31
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x798f6aa1
mov ecx, 0xb74e62a1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x41016f
mov dl, byte [ebp - 0x31]
mov eax, 0x287af96c
mov ecx, 0x1816080c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x41016f
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
add eax, 0xd621ca89
add eax, 0x18
sub eax, 0xd621ca89
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x7c], 0xd04eb5dc
jmp 0x41016f
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov ax, word [eax + 0x14]
mov word [ebp - 0x2a], ax
mov dword [ebp - 0x7c], 0x33b05074
jmp 0x41016f
mov ax, word [ebp - 0x2a]
movzx eax, ax
mov ecx, dword [ebp - 0x30]
sub ecx, 0x7c59ac30
add ecx, eax
add ecx, 0x7c59ac30
mov eax, dword [ebp - 0x50]
movzx eax, word [eax]
imul edx, eax, 0x28
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x4c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x42ecc9
call fcn.00422fc0
add esp, 8
mov edx, eax
mov eax, 0xc5d583a6
mov ecx, 0xff055a07
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x41016f
mov eax, dword [ebp - 0x48]
mov dword [eax], 0
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
add eax, 0x4a2c4057
add eax, ecx
sub eax, 0x4a2c4057
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x7c], 0x9e07f081
jmp 0x41016f
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x44]
mov byte [eax], cl
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x7c], 0x618c5201
jmp 0x41016f
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
sub ecx, 0x2b810b87
add ecx, eax
add ecx, 0x2b810b87
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x20]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0041f820
add esp, 0xc
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x68]
mov esi, dword [eax]
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub esi, 0xc8ede72f
add esi, eax
add esi, 0xc8ede72f
mov eax, dword [ebp - 0x48]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x44]
mov byte [eax], cl
mov dword [ebp - 0x7c], 0xff055a07
jmp 0x41016f
mov dword [ebp - 0x7c], 0xd856390c
jmp 0x41016f
mov eax, dword [0x4f1d54]
mov ecx, dword [0x4f1d50]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe736efd7
mov ecx, 0x391a3a93
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x41016f
mov eax, dword [ebp - 0x50]
mov ax, word [eax]
add ax, 0xfc13
add ax, 1
sub ax, 0xfc13
mov word [ebp - 0x12], ax
mov eax, dword [0x4f1d54]
mov ecx, dword [0x4f1d50]
mov edx, eax
sub edx, 0x61f1d528
sub edx, 1
add edx, 0x61f1d528
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe736efd7
mov ecx, 0x22f9677d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x41016f
mov dword [ebp - 0x7c], 0x2955b954
jmp 0x41016f
mov eax, dword [ebp - 0x50]
mov cx, word [ebp - 0x12]
mov word [eax], cx
mov dword [ebp - 0x7c], 0x64d04a14
jmp 0x41016f
mov dword [ebp - 0x7c], 0x6cf5c775
jmp 0x41016f
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x7c], 0x6bab271b
jmp 0x41016f
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x7c], 0x5c37f700
jmp 0x41016f
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0041e9d0
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
push eax
mov eax, esp
mov dword [ebp - 0x88], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x84], eax
push eax
mov eax, esp
mov dword [ebp - 0x8c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [ebp - 0x88]
mov edx, eax
mov eax, dword [ebp - 0x84]
mov dword [ecx], edx
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.0041f6c0
add esp, 0xc
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [ebp - 0x8c]
mov edx, dword [ebp - 0x88]
mov esi, eax
mov eax, dword [ebp - 0x84]
mov dword [ecx], esi
mov ecx, dword [ecx]
mov edx, dword [edx]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov dword [ebp - 0x7c], 0xdfa6e822
jmp 0x41016f
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x7c], 0x156909d4
jmp 0x41016f
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x7c], 0x161c508a
jmp 0x41016f
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x7c], 0x391a3a93
jmp 0x40f6e5