Function at 0x40ccf0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x74
mov eax, dword [0x47f880]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x78], 0x6b90c1c1
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x7c], eax
sub eax, 0x8f907166
je 0x40d6d3
jmp 0x40cd1f
mov eax, dword [ebp - 0x7c]
sub eax, 0x94eff3ae
je 0x40d370
jmp 0x40cd32
mov eax, dword [ebp - 0x7c]
sub eax, 0x96b6e6c0
je 0x40d421
jmp 0x40cd45
mov eax, dword [ebp - 0x7c]
sub eax, 0x987e651e
je 0x40d2dc
jmp 0x40cd58
mov eax, dword [ebp - 0x7c]
sub eax, 0xae00eb3c
je 0x40d7a7
jmp 0x40cd6b
mov eax, dword [ebp - 0x7c]
sub eax, 0xb321a965
je 0x40d415
jmp 0x40cd7e
mov eax, dword [ebp - 0x7c]
sub eax, 0xb533cd24
je 0x40d77a
jmp 0x40cd91
mov eax, dword [ebp - 0x7c]
sub eax, 0xb9358802
je 0x40d4c1
jmp 0x40cda4
mov eax, dword [ebp - 0x7c]
sub eax, 0xbbffb543
je 0x40d0b4
jmp 0x40cdb7
mov eax, dword [ebp - 0x7c]
sub eax, 0xc1b32703
je 0x40d534
jmp 0x40cdca
mov eax, dword [ebp - 0x7c]
sub eax, 0xd08ef743
je 0x40d5b8
jmp 0x40cddd
mov eax, dword [ebp - 0x7c]
sub eax, 0xd372a2bb
je 0x40d21d
jmp 0x40cdf0
mov eax, dword [ebp - 0x7c]
sub eax, 0xd7ac7299
je 0x40cfbe
jmp 0x40ce03
mov eax, dword [ebp - 0x7c]
sub eax, 0xe705a173
je 0x40d678
jmp 0x40ce16
mov eax, dword [ebp - 0x7c]
sub eax, 0xf03cb0da
je 0x40d66c
jmp 0x40ce29
mov eax, dword [ebp - 0x7c]
sub eax, 0xf0a28fdb
je 0x40d207
jmp 0x40ce3c
mov eax, dword [ebp - 0x7c]
sub eax, 0xf0bcce7e
je 0x40d26b
jmp 0x40ce4f
mov eax, dword [ebp - 0x7c]
sub eax, 0xf26c7298
je 0x40d68e
jmp 0x40ce62
mov eax, dword [ebp - 0x7c]
sub eax, 0xf50d096b
je 0x40d45e
jmp 0x40ce75
mov eax, dword [ebp - 0x7c]
sub eax, 0x193fa375
je 0x40d0a8
jmp 0x40ce88
mov eax, dword [ebp - 0x7c]
sub eax, 0x1f0f3222
je 0x40d6ff
jmp 0x40ce9b
mov eax, dword [ebp - 0x7c]
sub eax, 0x37a8aa0c
je 0x40d1e5
jmp 0x40ceae
mov eax, dword [ebp - 0x7c]
sub eax, 0x4d4e9530
je 0x40d2c1
jmp 0x40cec1
mov eax, dword [ebp - 0x7c]
sub eax, 0x4e035478
je 0x40d6c1
jmp 0x40ced4
mov eax, dword [ebp - 0x7c]
sub eax, 0x537a20c0
je 0x40d730
jmp 0x40cee7
mov eax, dword [ebp - 0x7c]
sub eax, 0x546493c1
je 0x40d6ab
jmp 0x40cefa
mov eax, dword [ebp - 0x7c]
sub eax, 0x59706475
je 0x40d2fd
jmp 0x40cf0d
mov eax, dword [ebp - 0x7c]
sub eax, 0x63f64891
je 0x40d5c4
jmp 0x40cf20
mov eax, dword [ebp - 0x7c]
sub eax, 0x661ff5ba
je 0x40d78c
jmp 0x40cf33
mov eax, dword [ebp - 0x7c]
sub eax, 0x6b90c1c1
je 0x40cf4b
jmp 0x40cf46
jmp 0x40d7b1
mov ecx, dword [0x480d4c]
mov eax, dword [0x480d48]
mov edx, ecx
add edx, 0xabf12ef4
sub edx, 1
sub edx, 0xabf12ef4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x537a20c0
mov ecx, 0xd7ac7299
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40d7b1
push eax
mov eax, esp
mov dword [ebp - 0x68], eax
push eax
mov eax, esp
mov dword [ebp - 0x64], eax
push eax
mov eax, esp
mov dword [ebp - 0x60], eax
push eax
mov eax, esp
mov dword [ebp - 0x5c], eax
push eax
mov eax, esp
mov dword [ebp - 0x58], eax
push eax
mov eax, esp
mov dword [ebp - 0x54], eax
push eax
mov eax, esp
mov dword [ebp - 0x50], eax
push eax
mov eax, esp
mov dword [ebp - 0x4c], eax
push eax
mov eax, esp
mov dword [ebp - 0x48], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x18]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.0041e110
add esp, 0xc
lea eax, [0x42cda8]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x44], eax
mov ecx, dword [0x480d4c]
mov eax, dword [0x480d48]
mov edx, ecx
sub edx, 0xa65f643f
sub edx, 1
add edx, 0xa65f643f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x537a20c0
mov ecx, 0x193fa375
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40d7b1
mov dword [ebp - 0x78], 0xbbffb543
jmp 0x40d7b1
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x6c]
lea eax, [ebp - 0x18]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x74], eax
lea eax, str.c:windows_system32_ntdll.dll
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x68]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x64]
mov dword [eax], ecx
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x60]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x5c]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
add ecx, 0x5fa42bbf
add ecx, eax
sub ecx, 0x5fa42bbf
mov eax, dword [ebp - 0x58]
mov dword [eax], ecx
mov eax, dword [ebp - 0x54]
mov word [eax], 0
mov dword [ebp - 0x78], 0x37a8aa0c
jmp 0x40d7b1
mov eax, dword [ebp - 0x54]
movzx eax, word [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov ax, word [eax + 6]
mov word [ebp - 0x3a], ax
mov dword [ebp - 0x78], 0xf0a28fdb
jmp 0x40d7b1
mov ax, word [ebp - 0x3a]
movzx eax, ax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x78], 0xd372a2bb
jmp 0x40d7b1
mov eax, dword [0x480d4c]
mov ecx, dword [0x480d48]
mov edx, eax
add edx, 0x5c668a29
sub edx, 1
sub edx, 0x5c668a29
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb533cd24
mov ecx, 0xf0bcce7e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40d7b1
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x38]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x31], al
mov eax, dword [0x480d4c]
mov ecx, dword [0x480d48]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb533cd24
mov ecx, 0x4d4e9530
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40d7b1
mov dl, byte [ebp - 0x31]
mov eax, 0x4e035478
mov ecx, 0x987e651e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40d7b1
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
add eax, 0xac8c393e
add eax, 0x18
sub eax, 0xac8c393e
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x78], 0x59706475
jmp 0x40d7b1
mov ecx, dword [0x480d4c]
mov eax, dword [0x480d48]
mov edx, ecx
sub edx, 0x9f78d589
sub edx, 1
add edx, 0x9f78d589
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x661ff5ba
mov ecx, 0x94eff3ae
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40d7b1
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
movzx ecx, word [eax + 0x14]
mov eax, dword [ebp - 0x30]
sub eax, 0x3248935f
add eax, ecx
add eax, 0x3248935f
mov ecx, dword [ebp - 0x54]
movzx ecx, word [ecx]
imul edx, ecx, 0x28
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x2c], eax
mov ecx, dword [0x480d4c]
mov eax, dword [0x480d48]
mov edx, ecx
sub edx, 0xd5843785
sub edx, 1
add edx, 0xd5843785
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x661ff5ba
mov ecx, 0xb321a965
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40d7b1
mov dword [ebp - 0x78], 0x96b6e6c0
jmp 0x40d7b1
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x2c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x50]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x42cdd0
call fcn.00421a10
add esp, 8
mov edx, eax
mov eax, 0xf50d096b
mov ecx, 0xf03cb0da
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40d7b1
mov eax, dword [ebp - 0x4c]
mov dword [eax], 0
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub edx, 0xe68d2ae3
add edx, eax
add edx, 0xe68d2ae3
mov eax, dword [ebp - 0x4c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x48]
mov byte [eax], cl
mov dword [ebp - 0x78], 0xb9358802
jmp 0x40d7b1
mov ecx, dword [0x480d4c]
mov eax, dword [0x480d48]
mov edx, ecx
add edx, 0x439f9f2b
sub edx, 1
sub edx, 0x439f9f2b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xae00eb3c
mov ecx, 0xc1b32703
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40d7b1
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x24], eax
mov ecx, dword [0x480d4c]
mov eax, dword [0x480d48]
mov edx, ecx
sub edx, 0x8d8f33b1
sub edx, 1
add edx, 0x8d8f33b1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xae00eb3c
mov ecx, 0xd08ef743
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x40d7b1
mov dword [ebp - 0x78], 0x63f64891
jmp 0x40d7b1
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
sub edx, 0xb9071494
add edx, eax
add edx, 0xb9071494
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub ecx, 0x3d8dfcff
add ecx, eax
add ecx, 0x3d8dfcff
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0041e270
add esp, 0xc
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov esi, dword [ebp - 0x74]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add esi, 0xf1098202
add esi, eax
sub esi, 0xf1098202
mov eax, dword [ebp - 0x4c]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x48]
mov byte [eax], cl
mov dword [ebp - 0x78], 0xf03cb0da
jmp 0x40d7b1
mov dword [ebp - 0x78], 0xe705a173
jmp 0x40d7b1
mov eax, dword [ebp - 0x54]
mov ax, word [eax]
mov word [ebp - 0x20], ax
mov dword [ebp - 0x78], 0xf26c7298
jmp 0x40d7b1
mov ax, word [ebp - 0x20]
xor ecx, ecx
sub cx, 1
sub ax, cx
mov word [ebp - 0x1e], ax
mov dword [ebp - 0x78], 0x546493c1
jmp 0x40d7b1
mov eax, dword [ebp - 0x54]
mov cx, word [ebp - 0x1e]
mov word [eax], cx
mov dword [ebp - 0x78], 0x37a8aa0c
jmp 0x40d7b1
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x78], 0x8f907166
jmp 0x40d7b1
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x78], 0x1f0f3222
jmp 0x40d7b1
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x70]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0041d420
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x18]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.0041e110
add esp, 0xc
lea eax, [0x42cda8]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x78], 0xd7ac7299
jmp 0x40d7b1
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x78], 0xf0bcce7e
jmp 0x40d7b1
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x78], 0x94eff3ae
jmp 0x40d7b1
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x78], 0xc1b32703
jmp 0x40cd09