Function at 0x40de30
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x84
mov eax, dword [0x44f680]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x7c], 0x68af7639
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x80], eax
sub eax, 0x809e1cde
je 0x40eaf6
jmp 0x40de62
mov eax, dword [ebp - 0x80]
sub eax, 0x824aa559
je 0x40e8cf
jmp 0x40de75
mov eax, dword [ebp - 0x80]
sub eax, 0x828c74c2
je 0x40eabd
jmp 0x40de88
mov eax, dword [ebp - 0x80]
sub eax, 0x83bcff60
je 0x40ea28
jmp 0x40de9b
mov eax, dword [ebp - 0x80]
sub eax, 0x861b4536
je 0x40e4de
jmp 0x40deae
mov eax, dword [ebp - 0x80]
sub eax, 0x87b9e4d7
je 0x40ed37
jmp 0x40dec1
mov eax, dword [ebp - 0x80]
sub eax, 0x92d35d10
je 0x40e403
jmp 0x40ded4
mov eax, dword [ebp - 0x80]
sub eax, 0xab52e084
je 0x40e69f
jmp 0x40dee7
mov eax, dword [ebp - 0x80]
sub eax, 0xac7a1cc9
je 0x40ecba
jmp 0x40defa
mov eax, dword [ebp - 0x80]
sub eax, 0xb430fb72
je 0x40e9b5
jmp 0x40df0d
mov eax, dword [ebp - 0x80]
sub eax, 0xc1bea4aa
je 0x40eaa5
jmp 0x40df20
mov eax, dword [ebp - 0x80]
sub eax, 0xe6947d34
je 0x40e398
jmp 0x40df33
mov eax, dword [ebp - 0x80]
sub eax, 0xe857a643
je 0x40eca8
jmp 0x40df46
mov eax, dword [ebp - 0x80]
sub eax, 0xf1ce1882
je 0x40e53f
jmp 0x40df59
mov eax, dword [ebp - 0x80]
sub eax, 0xf313484c
je 0x40e1ac
jmp 0x40df6c
mov eax, dword [ebp - 0x80]
sub eax, 0x33f525
je 0x40ed43
jmp 0x40df7f
mov eax, dword [ebp - 0x80]
sub eax, 0xbbac84b
je 0x40e566
jmp 0x40df92
mov eax, dword [ebp - 0x80]
sub eax, 0xc6a21e5
je 0x40e38c
jmp 0x40dfa5
mov eax, dword [ebp - 0x80]
sub eax, 0xede8b42
je 0x40ec7a
jmp 0x40dfb8
mov eax, dword [ebp - 0x80]
sub eax, 0x1250b67f
je 0x40e5d1
jmp 0x40dfcb
mov eax, dword [ebp - 0x80]
sub eax, 0x164d50c8
je 0x40e791
jmp 0x40dfde
mov eax, dword [ebp - 0x80]
sub eax, 0x22ac35f2
je 0x40e6d4
jmp 0x40dff1
mov eax, dword [ebp - 0x80]
sub eax, 0x251f7e14
je 0x40eb08
jmp 0x40e004
mov eax, dword [ebp - 0x80]
sub eax, 0x2b6ba10a
je 0x40ec96
jmp 0x40e017
mov eax, dword [ebp - 0x80]
sub eax, 0x2d92763a
je 0x40e490
jmp 0x40e02a
mov eax, dword [ebp - 0x80]
sub eax, 0x303d320e
je 0x40eab1
jmp 0x40e03d
mov eax, dword [ebp - 0x80]
sub eax, 0x34de1dfa
je 0x40e461
jmp 0x40e050
mov eax, dword [ebp - 0x80]
sub eax, 0x3848a9ae
je 0x40e980
jmp 0x40e063
mov eax, dword [ebp - 0x80]
sub eax, 0x3a8b6791
je 0x40e7df
jmp 0x40e076
mov eax, dword [ebp - 0x80]
sub eax, 0x3aadf3c1
je 0x40e915
jmp 0x40e089
mov eax, dword [ebp - 0x80]
sub eax, 0x448cd49f
je 0x40e8c3
jmp 0x40e09c
mov eax, dword [ebp - 0x80]
sub eax, 0x4a57b578
je 0x40e667
jmp 0x40e0af
mov eax, dword [ebp - 0x80]
sub eax, 0x4bb098ad
je 0x40e673
jmp 0x40e0c2
mov eax, dword [ebp - 0x80]
sub eax, 0x647053a4
je 0x40e763
jmp 0x40e0d5
mov eax, dword [ebp - 0x80]
sub eax, 0x66cd08ae
je 0x40e46d
jmp 0x40e0e8
mov eax, dword [ebp - 0x80]
sub eax, 0x688cbb0a
je 0x40e98c
jmp 0x40e0fb
mov eax, dword [ebp - 0x80]
sub eax, 0x68af7639
je 0x40e139
jmp 0x40e10e
mov eax, dword [ebp - 0x80]
sub eax, 0x77ec4e9e
je 0x40e54b
jmp 0x40e121
mov eax, dword [ebp - 0x80]
sub eax, 0x7a1995e4
je 0x40eb28
jmp 0x40e134
jmp 0x40ed54
mov ecx, dword [0x450b54]
mov eax, dword [0x450b50]
mov edx, ecx
add edx, 0x2ed82a6b
sub edx, 1
sub edx, 0x2ed82a6b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7a1995e4
mov ecx, 0xf313484c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40ed54
push eax
mov eax, esp
mov dword [ebp - 0x64], eax
push eax
mov eax, esp
mov dword [ebp - 0x84], eax
push eax
mov eax, esp
mov dword [ebp - 0x60], eax
push eax
mov eax, esp
mov dword [ebp - 0x5c], eax
push eax
mov eax, esp
mov dword [ebp - 0x58], eax
push eax
mov eax, esp
mov dword [ebp - 0x54], eax
push eax
mov eax, esp
mov dword [ebp - 0x50], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x18]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.0041e8a0
add esp, 0xc
lea eax, [0x42dd98]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x6c], eax
mov ecx, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x68]
lea eax, [ebp - 0x18]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x70], eax
lea eax, str.c:windows_system32_ntdll.dll
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [ebp - 0x84]
mov edx, eax
mov eax, dword [ebp - 0x64]
mov dword [eax], edx
mov eax, dword [ebp - 0x70]
mov dword [ecx], eax
mov eax, dword [ebp - 0x70]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x3c]
add eax, 0xbd74457e
add eax, ecx
sub eax, 0xbd74457e
mov dword [ebp - 0x4c], eax
mov ecx, dword [0x450b54]
mov eax, dword [0x450b50]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7a1995e4
mov ecx, 0xc6a21e5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40ed54
mov dword [ebp - 0x7c], 0xe6947d34
jmp 0x40ed54
mov ecx, dword [0x450b54]
mov eax, dword [0x450b50]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xede8b42
mov ecx, 0x92d35d10
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40ed54
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x60]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5c]
mov word [eax], 0
mov eax, dword [0x450b54]
mov ecx, dword [0x450b50]
mov edx, eax
add edx, 0xe0e4cc12
sub edx, 1
sub edx, 0xe0e4cc12
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xede8b42
mov ecx, 0x34de1dfa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40ed54
mov dword [ebp - 0x7c], 0x66cd08ae
jmp 0x40ed54
mov eax, dword [ebp - 0x5c]
movzx eax, word [eax]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
add eax, 4
add eax, 2
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x7c], 0x2d92763a
jmp 0x40ed54
mov eax, dword [0x450b54]
mov ecx, dword [0x450b50]
mov edx, eax
sub edx, 0xed1efb75
sub edx, 1
add edx, 0xed1efb75
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2b6ba10a
mov ecx, 0x861b4536
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40ed54
mov eax, dword [ebp - 0x44]
movzx ecx, word [eax]
mov eax, dword [ebp - 0x48]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x3d], al
mov eax, dword [0x450b54]
mov ecx, dword [0x450b50]
mov edx, eax
sub edx, 0xbcc468ef
sub edx, 1
add edx, 0xbcc468ef
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2b6ba10a
mov ecx, 0xf1ce1882
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40ed54
mov dword [ebp - 0x7c], 0x77ec4e9e
jmp 0x40ed54
mov dl, byte [ebp - 0x3d]
mov eax, 0x828c74c2
mov ecx, 0xbbac84b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40ed54
mov ecx, dword [0x450b54]
mov eax, dword [0x450b50]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe857a643
mov ecx, 0x1250b67f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40ed54
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x18
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
mov dword [ebp - 0x38], eax
mov ecx, dword [0x450b54]
mov eax, dword [0x450b50]
mov edx, ecx
sub edx, 0xae6fb703
sub edx, 1
add edx, 0xae6fb703
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe857a643
mov ecx, 0x4a57b578
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40ed54
mov dword [ebp - 0x7c], 0x4bb098ad
jmp 0x40ed54
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x5c]
movzx eax, word [eax]
imul edx, eax, 0x28
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x58]
mov dword [eax], ecx
mov dword [ebp - 0x7c], 0xab52e084
jmp 0x40ed54
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x42ddc0
call fcn.004221b0
add esp, 8
mov edx, eax
mov eax, 0x22ac35f2
mov ecx, 0x824aa559
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40ed54
mov eax, dword [ebp - 0x54]
mov dword [eax], 0
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, edx
xor edx, edx
sub edx, esi
add eax, edx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x54]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x50]
mov byte [eax], cl
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x58]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x7c], 0x647053a4
jmp 0x40ed54
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 0x30]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x7c], 0x164d50c8
jmp 0x40ed54
mov eax, dword [0x450b54]
mov ecx, dword [0x450b50]
mov edx, eax
sub edx, 0xfe4e1c3d
sub edx, 1
add edx, 0xfe4e1c3d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xac7a1cc9
mov ecx, 0x3a8b6791
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40ed54
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x28]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0041ea00
add esp, 0xc
mov eax, dword [ebp - 0x54]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov esi, dword [ebp - 0x70]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub esi, 0xe3efdd6b
add esi, eax
add esi, 0xe3efdd6b
mov eax, dword [ebp - 0x54]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x50]
mov byte [eax], cl
mov ecx, dword [0x450b54]
mov eax, dword [0x450b50]
mov edx, ecx
sub edx, 0x285464c1
sub edx, 1
add edx, 0x285464c1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xac7a1cc9
mov ecx, 0x448cd49f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40ed54
mov dword [ebp - 0x7c], 0x824aa559
jmp 0x40ed54
mov eax, dword [0x450b54]
mov ecx, dword [0x450b50]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x87b9e4d7
mov ecx, 0x3aadf3c1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40ed54
mov ecx, dword [0x450b54]
mov eax, dword [0x450b50]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x87b9e4d7
mov ecx, 0x3848a9ae
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40ed54
mov dword [ebp - 0x7c], 0x688cbb0a
jmp 0x40ed54
mov eax, dword [ebp - 0x5c]
mov ax, word [eax]
xor ecx, ecx
sub cx, ax
xor eax, eax
sub ax, 1
add cx, ax
xor eax, eax
sub ax, cx
mov word [ebp - 0x1e], ax
mov dword [ebp - 0x7c], 0xb430fb72
jmp 0x40ed54
mov ecx, dword [0x450b54]
mov eax, dword [0x450b50]
mov edx, ecx
add edx, 0x41d802bc
sub edx, 1
sub edx, 0x41d802bc
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x33f525
mov ecx, 0x83bcff60
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40ed54
mov eax, dword [ebp - 0x5c]
mov cx, word [ebp - 0x1e]
mov word [eax], cx
mov ecx, dword [0x450b54]
mov eax, dword [0x450b50]
mov edx, ecx
add edx, 0x7537ce88
sub edx, 1
sub edx, 0x7537ce88
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x33f525
mov ecx, 0xc1bea4aa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40ed54
mov dword [ebp - 0x7c], 0x303d320e
jmp 0x40ed54
mov dword [ebp - 0x7c], 0x66cd08ae
jmp 0x40ed54
mov eax, dword [ebp - 0x68]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x74]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x78]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x7c], 0x809e1cde
jmp 0x40ed54
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x7c], 0x251f7e14
jmp 0x40ed54
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0041dbb0
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
push eax
mov eax, esp
mov dword [ebp - 0x8c], eax
push eax
mov eax, esp
mov dword [ebp - 0x88], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x18]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.0041e8a0
add esp, 0xc
lea eax, [0x42dd98]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x6c], eax
mov ecx, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x68]
lea eax, [ebp - 0x18]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x70], eax
lea eax, str.c:windows_system32_ntdll.dll
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [ebp - 0x8c]
mov edx, eax
mov eax, dword [ebp - 0x88]
mov dword [ecx], edx
mov ecx, dword [ebp - 0x70]
mov dword [eax], ecx
mov dword [ebp - 0x7c], 0xf313484c
jmp 0x40ed54
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x60]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5c]
mov word [eax], 0
mov dword [ebp - 0x7c], 0x92d35d10
jmp 0x40ed54
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x7c], 0x861b4536
jmp 0x40ed54
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x7c], 0x1250b67f
jmp 0x40ed54
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x28]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0041ea00
add esp, 0xc
mov eax, dword [ebp - 0x54]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov esi, dword [ebp - 0x70]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub esi, 0xe6ca5178
add esi, eax
add esi, 0xe6ca5178
mov eax, dword [ebp - 0x54]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x50]
mov byte [eax], cl
mov dword [ebp - 0x7c], 0x3a8b6791
jmp 0x40ed54
mov dword [ebp - 0x7c], 0x3aadf3c1
jmp 0x40ed54
mov eax, dword [ebp - 0x5c]
mov cx, word [ebp - 0x1e]
mov word [eax], cx
mov dword [ebp - 0x7c], 0x83bcff60
jmp 0x40de4c