Function at 0x40ab80
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421b58
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x42c00c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, ecx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x50], eax
xor edi, edi
mov eax, 0x490
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x74], eax
xor eax, eax
mov dword [ebp - 0x5c], eax
xor al, al
mov byte [ebp - 0x3d], al
mov byte [ebp - 0x3e], al
xor eax, eax
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x78], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor ecx, ecx
movzx eax, ax
mov dword [ebp - 0x4c], ecx
cmp dword [ebp - 0x44], ecx
jne 0x40abff
mov dword [ebp - 0x64], 0x57
xor edi, edi
jmp 0x40b51e
mov ecx, 0x105
cmp ax, cx
je 0x40acd9
push str.GetSystemFirmwareTable
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x40abf8
push 0
push 0
push 0
push 0x52534d42
mov ecx, esi
call dword [0x42227c]
call esi
mov edi, eax
test edi, edi
je 0x40abf8
xor ecx, ecx
add eax, 0x400
setb cl
neg ecx
or ecx, eax
push ecx
call fcn.00415b3d
mov ecx, eax
add esp, 4
mov dword [ebp - 0x68], ecx
test ecx, ecx
jne 0x40ac73
mov dword [ebp - 0x64], 8
mov edi, eax
jmp 0x40b51e
lea eax, [edi + 0x400]
push eax
push 0
push ecx
call fcn.00410b20
add esp, 0xc
mov ecx, esi
push edi
mov edi, dword [ebp - 0x68]
push edi
push 0
push 0x52534d42
call dword [0x42227c]
call esi
test eax, eax
je 0x40b51e
mov edx, edi
mov al, byte [edx + 1]
mov cl, byte [edx + 2]
mov byte [ebp - 0x3d], al
mov byte [ebp - 0x3e], cl
cmp al, 2
jae 0x40acc1
mov dword [ebp - 0x64], 0x718
jmp 0x40b51e
mov eax, dword [edx + 4]
lea edi, [edx + 8]
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x64], 0
jmp 0x40af31
push str.NtOpenSection
push str.ntdll.dll
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], 0x2e002c
mov dword [ebp - 0x20], str.DevicePhysicalMemory
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x40af07
lea eax, [ebp - 0x24]
mov dword [ebp - 0x3c], 0x18
mov dword [ebp - 0x34], eax
mov ecx, esi
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x38], 0
push eax
push 4
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x30], 0x40
push eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
call dword [0x42227c]
call esi
test eax, eax
js 0x40af07
push 0x10000
push 0xf0000
push 0
push 4
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov dword [ebp - 0x4c], esi
test esi, esi
je 0x40af09
xor eax, eax
nop dword [eax]
cmp dword [esi], 0x5f4d535f
je 0x40ad95
add eax, 0x10
add esi, 0x10
cmp eax, 0x10000
jb 0x40ad80
mov ecx, dword [ebp - 0x4c]
mov eax, esi
sub eax, ecx
cmp eax, 0x10000
je 0x40af03
mov al, byte [esi + 5]
cmp al, 0x1f
ja 0x40af03
cmp al, 0x1e
je 0x40adbe
cmp al, 0x1f
jne 0x40af03
movzx eax, al
sub eax, ecx
add eax, esi
cmp eax, 0x10000
ja 0x40af03
movzx eax, word [esi + 0x16]
test ax, ax
je 0x40af03
mov ecx, 0x494d445f
cmp ecx, dword [esi + 0x10]
jne 0x40aefe
mov ecx, 0x5f
cmp cl, byte [esi + 0x14]
jne 0x40aefe
mov cl, byte [esi + 6]
mov dl, byte [esi + 7]
mov byte [ebp - 0x3d], cl
mov byte [ebp - 0x3e], dl
cmp cl, 2
jb 0x40aefe
push dword [ebp - 0x4c]
mov esi, dword [esi + 0x18]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, esi
lea eax, [edi + 0xfff]
and ecx, 0xfff
add eax, ecx
mov dword [ebp - 0x74], ecx
and eax, 0xfffff000
sub esi, ecx
push eax
push esi
push 0
push 4
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov dword [ebp - 0x4c], esi
test esi, esi
je 0x40aefa
xor ecx, ecx
mov eax, edi
add eax, 0x400
setb cl
neg ecx
or ecx, eax
push ecx
call fcn.00415b3d
mov edx, eax
add esp, 4
mov dword [ebp - 0x78], edx
test edx, edx
jne 0x40ae83
mov ecx, 8
xor edi, edi
mov dword [ebp - 0x64], ecx
jmp 0x40af0e
lea eax, [edi + 0x400]
push eax
push 0
push edx
call fcn.00410b20
mov eax, dword [ebp - 0x74]
push edi
add eax, esi
push eax
push dword [ebp - 0x78]
call fcn.004127e0
mov eax, dword [ebp - 0x78]
add esp, 0x18
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x5c], edi
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edi, dword [ebp - 0x70]
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x64], ecx
jmp 0x40af0e
xor edi, edi
jmp 0x40af09
mov esi, dword [ebp - 0x4c]
jmp 0x40af09
mov esi, ecx
jmp 0x40af09
xor esi, esi
mov ecx, 0x490
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40af26
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x64]
test ecx, ecx
jne 0x40b510
mov eax, dword [ebp - 0x5c]
push 1
lea ecx, [ebp - 0x50]
mov edx, eax
push ecx
push 1
mov ecx, edi
call fcn.0040aaa0
add esp, 0xc
test eax, eax
jne 0x40af7c
mov esi, dword [ebp - 0x50]
mov ecx, esi
mov eax, dword [ebp - 0x44]
add eax, 4
push eax
mov dl, byte [esi + 7]
call fcn.0040a840
mov al, byte [ebp - 0x3d]
add esp, 4
cmp al, 2
ja 0x40af6f
jne 0x40af7c
cmp byte [ebp - 0x3e], 1
jb 0x40af7c
movups xmm0, xmmword [esi + 8]
mov esi, dword [ebp - 0x44]
movups xmmword [esi + 8], xmm0
jmp 0x40af7f
mov esi, dword [ebp - 0x44]
mov edx, dword [ebp - 0x5c]
lea eax, [ebp - 0x50]
push 1
push eax
push 2
mov ecx, edi
call fcn.0040aaa0
add esp, 0xc
test eax, eax
jne 0x40afbd
lea eax, [esi + 0x18]
mov esi, dword [ebp - 0x50]
push eax
mov ecx, esi
mov dl, byte [esi + 7]
call fcn.0040a840
mov eax, dword [ebp - 0x44]
mov ecx, esi
mov dl, byte [esi + 8]
add eax, 0x1c
push eax
call fcn.0040a840
add esp, 8
mov edx, dword [ebp - 0x5c]
lea eax, [ebp - 0x50]
push 1
push eax
push 3
mov ecx, edi
call fcn.0040aaa0
add esp, 0xc
test eax, eax
jne 0x40affe
mov esi, dword [ebp - 0x50]
mov ecx, esi
mov eax, dword [ebp - 0x44]
add eax, 0x20
push eax
mov dl, byte [esi + 7]
call fcn.0040a840
mov eax, dword [ebp - 0x44]
mov ecx, esi
mov dl, byte [esi + 8]
add eax, 0x24
push eax
call fcn.0040a840
add esp, 8
mov edx, dword [ebp - 0x5c]
lea eax, [ebp - 0x50]
push 1
push eax
push 4
mov ecx, edi
call fcn.0040aaa0
add esp, 0xc
test eax, eax
jne 0x40b057
mov esi, dword [ebp - 0x50]
mov edi, dword [ebp - 0x44]
mov eax, dword [esi + 8]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0x2c], eax
mov al, byte [ebp - 0x3d]
cmp al, 2
ja 0x40b038
jne 0x40b057
cmp byte [ebp - 0x3e], 3
jb 0x40b057
mov dl, byte [esi + 0x20]
lea eax, [edi + 0x30]
push eax
mov ecx, esi
call fcn.0040a840
mov dl, byte [esi + 0x21]
lea eax, [edi + 0x34]
push eax
mov ecx, esi
call fcn.0040a840
add esp, 8
mov byte [ebp - 0x45], 1
nop dword [eax + eax]
mov dword [ebp - 4], 2
call fcn.00407950
mov edi, eax
test edi, edi
je 0x40b55c
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x42227c]
mov ecx, edi
call esi
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
mov eax, dword [ebp - 0x70]
mov cl, 1
mov dword [ebp - 4], 3
test eax, eax
je 0x40b0df
mov edx, dword [ebp - 0x5c]
test edx, edx
je 0x40b0df
add edx, eax
mov edi, eax
add eax, 4
cmp eax, edx
ja 0x40b0df
mov ch, byte [ebp - 0x45]
cmp byte [edi], 0x11
jne 0x40b0c1
cmp ch, cl
je 0x40b179
inc cl
movzx eax, byte [edi + 1]
add eax, edi
cmp byte [eax], 0
jne 0x40b0d2
cmp byte [eax + 1], 0
je 0x40b0d5
inc eax
jmp 0x40b0c7
lea edi, [eax + 2]
add eax, 6
cmp eax, edx
jbe 0x40b0b2
lea ecx, [esi - 0x10]
mov dword [ebp - 4], 4
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x40b10a
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x42227c]
mov ecx, edi
call esi
mov dword [ebp - 4], 0xffffffff
mov dh, byte [ebp - 0x3d]
cmp dh, 2
ja 0x40b12a
jne 0x40b485
mov al, byte [ebp - 0x3e]
cmp al, 1
jb 0x40b490
mov eax, dword [ebp - 0x70]
mov dl, 1
test eax, eax
je 0x40b482
mov esi, dword [ebp - 0x5c]
test esi, esi
je 0x40b482
add esi, eax
mov ecx, eax
add eax, 4
cmp eax, esi
ja 0x40b482
cmp byte [ecx], 0x16
jne 0x40b161
cmp dl, 1
je 0x40b46d
inc dl
movzx eax, byte [ecx + 1]
add eax, ecx
cmp byte [eax], 0
jne 0x40b176
cmp byte [eax + 1], 0
je 0x40b45d
inc eax
jmp 0x40b167
mov al, byte [ebp - 0x3d]
cmp al, 2
ja 0x40b190
jne 0x40b41c
cmp byte [ebp - 0x3e], 3
jb 0x40b41c
mov dl, byte [edi + 0x1a]
lea eax, [ebp - 0x18]
push eax
mov ecx, edi
call fcn.0040a840
add esp, 4
test eax, eax
jne 0x40b26c
mov eax, dword [ebp - 0x44]
mov esi, dword [ebp - 0x18]
mov edx, esi
mov eax, dword [eax + 0x38]
sub edx, eax
mov ecx, dword [esi - 0xc]
mov dword [ebp - 0x60], edx
mov edx, dword [eax - 0xc]
mov dword [ebp - 0x54], edx
test ecx, ecx
js 0x40b566
test esi, esi
jne 0x40b1d2
xor ecx, ecx
jmp 0x40b1e1
push ecx
push esi
call fcn.004138d5
mov edx, dword [ebp - 0x54]
add esp, 8
mov ecx, eax
mov eax, 0x7fffffff
mov dword [ebp - 0x58], ecx
sub eax, ecx
cmp eax, edx
jl 0x40b566
add edx, ecx
mov dword [ebp - 0x7c], edx
js 0x40b566
mov eax, dword [ebp - 0x44]
mov ecx, 1
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x50], eax
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edx
or eax, ecx
jge 0x40b22c
mov ecx, dword [ebp - 0x44]
push edx
lea ecx, [ecx + 0x38]
call fcn.0040b980
mov edx, dword [ebp - 0x44]
mov ecx, dword [edx + 0x38]
jmp 0x40b22f
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x60]
mov esi, dword [ebp - 0x60]
add eax, ecx
cmp esi, dword [ebp - 0x54]
mov edx, dword [ebp - 0x58]
cmova eax, dword [ebp - 0x18]
add ecx, dword [ebp - 0x54]
push edx
push eax
call fcn.004076d0
mov esi, dword [ebp - 0x44]
add esp, 8
mov ecx, dword [ebp - 0x7c]
mov edx, dword [esi + 0x38]
cmp ecx, dword [edx - 8]
jg 0x40b566
mov dword [edx - 0xc], ecx
mov eax, dword [esi + 0x38]
mov byte [ecx + eax], 0
jmp 0x40b26f
mov esi, dword [ebp - 0x44]
mov dl, byte [edi + 0x18]
lea eax, [ebp - 0x18]
push eax
mov ecx, edi
call fcn.0040a840
add esp, 4
test eax, eax
jne 0x40b348
lea eax, [esi + 0x3c]
mov esi, dword [ebp - 0x18]
mov eax, dword [eax]
mov edx, esi
sub edx, eax
mov dword [ebp - 0x58], edx
mov ecx, dword [esi - 0xc]
mov edx, dword [eax - 0xc]
mov dword [ebp - 0x54], edx
test ecx, ecx
js 0x40b566
test esi, esi
jne 0x40b2b0
xor ecx, ecx
jmp 0x40b2bf
push ecx
push esi
call fcn.004138d5
mov edx, dword [ebp - 0x54]
add esp, 8
mov ecx, eax
mov eax, 0x7fffffff
mov dword [ebp - 0x60], ecx
sub eax, ecx
cmp eax, edx
jl 0x40b566
add edx, ecx
mov dword [ebp - 0x7c], edx
js 0x40b566
mov eax, dword [ebp - 0x44]
mov ecx, 1
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x50], eax
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edx
or eax, ecx
jge 0x40b30a
mov ecx, dword [ebp - 0x44]
push edx
lea ecx, [ecx + 0x3c]
call fcn.0040b980
mov edx, dword [ebp - 0x44]
mov ecx, dword [edx + 0x3c]
jmp 0x40b30d
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x58]
mov esi, dword [ebp - 0x58]
add eax, ecx
cmp esi, dword [ebp - 0x54]
mov edx, dword [ebp - 0x60]
cmova eax, dword [ebp - 0x18]
add ecx, dword [ebp - 0x54]
push edx
push eax
call fcn.004076d0
mov esi, dword [ebp - 0x44]
add esp, 8
mov ecx, dword [ebp - 0x7c]
mov edx, dword [esi + 0x3c]
cmp ecx, dword [edx - 8]
jg 0x40b566
mov dword [edx - 0xc], ecx
mov eax, dword [esi + 0x3c]
mov byte [ecx + eax], 0
mov dl, byte [edi + 0x19]
lea eax, [ebp - 0x18]
push eax
mov ecx, edi
call fcn.0040a840
add esp, 4
test eax, eax
jne 0x40b419
mov eax, dword [esi + 0x40]
lea ecx, [esi + 0x40]
mov esi, dword [ebp - 0x18]
mov edi, esi
sub edi, eax
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x60], edi
mov edi, dword [eax - 0xc]
mov edx, dword [esi - 0xc]
mov dword [ebp - 0x74], edi
test edx, edx
js 0x40b566
test esi, esi
jne 0x40b38d
xor edx, edx
jmp 0x40b39c
push edx
push esi
call fcn.004138d5
mov ecx, dword [ebp - 0x54]
add esp, 8
mov edx, eax
mov eax, 0x7fffffff
mov dword [ebp - 0x58], edx
sub eax, edx
cmp eax, edi
jl 0x40b566
add edi, edx
js 0x40b566
mov eax, dword [ecx]
mov ecx, 1
mov dword [ebp - 0x50], eax
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or eax, ecx
jge 0x40b3df
mov ecx, dword [ebp - 0x54]
push edi
call fcn.0040b980
mov eax, dword [ebp - 0x54]
mov edx, dword [ebp - 0x58]
mov ecx, dword [eax]
jmp 0x40b3e2
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x60]
push edx
mov edx, dword [ebp - 0x60]
add eax, ecx
cmp edx, dword [ebp - 0x74]
mov edx, dword [ebp - 0x58]
cmova eax, esi
add ecx, dword [ebp - 0x74]
push eax
call fcn.004076d0
mov eax, dword [ebp - 0x54]
add esp, 8
mov ecx, dword [eax]
cmp edi, dword [ecx - 8]
jg 0x40b566
mov dword [ecx - 0xc], edi
mov eax, dword [eax]
mov byte [edi + eax], 0
jmp 0x40b41c
mov esi, dword [ebp - 0x18]
lea ecx, [esi - 0x10]
mov dword [ebp - 4], 5
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x40b447
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x42227c]
mov ecx, edi
call esi
add byte [ebp - 0x45], 1
mov dword [ebp - 4], 0xffffffff
jne 0x40b060
jmp 0x40b111
lea ecx, [eax + 2]
lea eax, [ecx + 4]
cmp eax, esi
jbe 0x40b151
jmp 0x40b482
mov eax, dword [ebp - 0x44]
mov dl, byte [ecx + 7]
add eax, 0x44
push eax
call fcn.0040a840
mov dh, byte [ebp - 0x3d]
add esp, 4
cmp dh, 2
ja 0x40b494
jne 0x40b50d
mov al, byte [ebp - 0x3e]
cmp al, 3
jb 0x40b50d
mov esi, dword [ebp - 0x70]
mov cl, 1
test esi, esi
je 0x40b50d
mov eax, dword [ebp - 0x5c]
test eax, eax
je 0x40b50d
lea edx, [eax + esi]
lea eax, [esi + 4]
cmp eax, edx
ja 0x40b50d
nop
cmp byte [esi], 0x27
jne 0x40b4bd
cmp cl, 1
je 0x40b4dd
add cl, 1
movzx eax, byte [esi + 1]
add eax, esi
cmp byte [eax], 0
jne 0x40b4ce
cmp byte [eax + 1], 0
je 0x40b4d1
inc eax
jmp 0x40b4c3
lea esi, [eax + 2]
lea eax, [esi + 4]
cmp eax, edx
jbe 0x40b4b0
jmp 0x40b50d
mov edi, dword [ebp - 0x44]
mov ecx, esi
mov dl, byte [esi + 0xa]
lea eax, [edi + 0x48]
push eax
call fcn.0040a840
mov dl, byte [esi + 8]
lea eax, [edi + 0x4c]
push eax
mov ecx, esi
call fcn.0040a840
mov dl, byte [esi + 9]
lea eax, [edi + 0x50]
push eax
mov ecx, esi
call fcn.0040a840
add esp, 0xc
mov esi, dword [ebp - 0x4c]
test esi, esi
je 0x40b51b
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edi, dword [ebp - 0x68]
push 0
call fcn.00415b20
push edi
call fcn.00415b20
push dword [ebp - 0x78]
call fcn.00415b20
mov eax, dword [ebp - 0x44]
add esp, 0xc
mov ecx, dword [ebp - 0x64]
mov dword [eax], ecx
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040f2ed
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00407790
push 0x80070057
call fcn.00407790
int3