Function at 0x40ea30
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x80
mov eax, dword [0x480080]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x48156c]
mov eax, dword [0x481568]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x76], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x75], al
mov dword [ebp - 0x7c], 0xaaa01c4e
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x80], eax
sub eax, 0x8028450e
je 0x40f74b
jmp 0x40ea94
mov eax, dword [ebp - 0x80]
sub eax, 0x8608241e
je 0x40f2e8
jmp 0x40eaa7
mov eax, dword [ebp - 0x80]
sub eax, 0x889af4a3
je 0x40f676
jmp 0x40eaba
mov eax, dword [ebp - 0x80]
sub eax, 0x8ad4df88
je 0x40f597
jmp 0x40eacd
mov eax, dword [ebp - 0x80]
sub eax, 0x915647b4
je 0x40f04a
jmp 0x40eae0
mov eax, dword [ebp - 0x80]
sub eax, 0xaaa01c4e
je 0x40ed45
jmp 0x40eaf3
mov eax, dword [ebp - 0x80]
sub eax, 0xb45b1c7e
je 0x40ee7e
jmp 0x40eb06
mov eax, dword [ebp - 0x80]
sub eax, 0xba1c7bfa
je 0x40f3ff
jmp 0x40eb19
mov eax, dword [ebp - 0x80]
sub eax, 0xc17e161c
je 0x40eedf
jmp 0x40eb2c
mov eax, dword [ebp - 0x80]
sub eax, 0xc1fcea2f
je 0x40f817
jmp 0x40eb3f
mov eax, dword [ebp - 0x80]
sub eax, 0xcefc1bbb
je 0x40f693
jmp 0x40eb52
mov eax, dword [ebp - 0x80]
sub eax, 0xd1135000
je 0x40f524
jmp 0x40eb65
mov eax, dword [ebp - 0x80]
sub eax, 0xd74db407
je 0x40f03e
jmp 0x40eb78
mov eax, dword [ebp - 0x80]
sub eax, 0xe35d6daa
je 0x40f875
jmp 0x40eb8b
mov eax, dword [ebp - 0x80]
sub eax, 0xf259f57e
je 0x40f62b
jmp 0x40eb9e
mov eax, dword [ebp - 0x80]
sub eax, 0xf2665f24
je 0x40ed6b
jmp 0x40ebb1
mov eax, dword [ebp - 0x80]
sub eax, 0xf3d62fc2
je 0x40f15e
jmp 0x40ebc4
mov eax, dword [ebp - 0x80]
sub eax, 0xf6b52bea
je 0x40f2a9
jmp 0x40ebd7
mov eax, dword [ebp - 0x80]
sub eax, 0xffb2d119
je 0x40f187
jmp 0x40ebea
mov eax, dword [ebp - 0x80]
sub eax, 0x15d5c1
je 0x40f472
jmp 0x40ebfd
mov eax, dword [ebp - 0x80]
sub eax, 0x9886e9f
je 0x40f067
jmp 0x40ec10
mov eax, dword [ebp - 0x80]
sub eax, 0xac0b6b1
je 0x40f2b5
jmp 0x40ec23
mov eax, dword [ebp - 0x80]
sub eax, 0x10ccbf91
je 0x40f637
jmp 0x40ec36
mov eax, dword [ebp - 0x80]
sub eax, 0x17346d3e
je 0x40f50e
jmp 0x40ec49
mov eax, dword [ebp - 0x80]
sub eax, 0x188bfbf8
je 0x40f31b
jmp 0x40ec5c
mov eax, dword [ebp - 0x80]
sub eax, 0x3638ad7a
je 0x40ef25
jmp 0x40ec6f
mov eax, dword [ebp - 0x80]
sub eax, 0x376a4557
je 0x40ee72
jmp 0x40ec82
mov eax, dword [ebp - 0x80]
sub eax, 0x38a872eb
je 0x40f6a5
jmp 0x40ec95
mov eax, dword [ebp - 0x80]
sub eax, 0x398b370a
je 0x40f858
jmp 0x40eca8
mov eax, dword [ebp - 0x80]
sub eax, 0x3a294c0c
je 0x40f1fa
jmp 0x40ecbb
mov eax, dword [ebp - 0x80]
sub eax, 0x3ad81339
je 0x40f4f6
jmp 0x40ecce
mov eax, dword [ebp - 0x80]
sub eax, 0x3b1574f3
je 0x40f07f
jmp 0x40ece1
mov eax, dword [ebp - 0x80]
sub eax, 0x3c73446d
je 0x40f61f
jmp 0x40ecf4
mov eax, dword [ebp - 0x80]
sub eax, 0x3f2f1d71
je 0x40f502
jmp 0x40ed07
mov eax, dword [ebp - 0x80]
sub eax, 0x51a1e870
je 0x40f143
jmp 0x40ed1a
mov eax, dword [ebp - 0x80]
sub eax, 0x53735e17
je 0x40f0ea
jmp 0x40ed2d
mov eax, dword [ebp - 0x80]
sub eax, 0x7f7f38a9
je 0x40f805
jmp 0x40ed40
jmp 0x40f898
mov al, byte [ebp - 0x76]
mov cl, byte [ebp - 0x75]
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x38a872eb
mov ecx, 0xf2665f24
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40f898
push eax
mov eax, esp
mov dword [ebp - 0x74], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x70], eax
push eax
mov eax, esp
mov dword [ebp - 0x6c], eax
push eax
mov eax, esp
mov dword [ebp - 0x68], eax
push eax
mov eax, esp
mov dword [ebp - 0x64], eax
push eax
mov eax, esp
mov dword [ebp - 0x60], eax
push eax
mov eax, esp
mov dword [ebp - 0x5c], eax
push eax
mov eax, esp
mov dword [ebp - 0x58], eax
push eax
mov eax, esp
mov dword [ebp - 0x54], eax
push eax
mov eax, esp
mov dword [ebp - 0x50], eax
push eax
mov eax, esp
mov dword [ebp - 0x4c], eax
push eax
mov eax, esp
mov dword [ebp - 0x48], eax
push eax
mov eax, esp
mov dword [ebp - 0x44], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.0041f0f0
add esp, 0xc
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x74]
mov edx, dword [eax]
mov eax, dword [ebp - 0x70]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [0x48156c]
mov ecx, dword [0x481568]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x38a872eb
mov ecx, 0x376a4557
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40f898
mov dword [ebp - 0x7c], 0xb45b1c7e
jmp 0x40f898
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x68]
mov dword [eax], ecx
lea eax, str.c:windows_system32_ntdll.dll
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x64]
mov dword [eax], ecx
mov dword [ebp - 0x7c], 0xc17e161c
jmp 0x40f898
mov eax, dword [0x48156c]
mov ecx, dword [0x481568]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8028450e
mov ecx, 0x3638ad7a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40f898
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x60]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x5c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x58]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
sub ecx, 0xb077b92a
add ecx, eax
add ecx, 0xb077b92a
mov eax, dword [ebp - 0x54]
mov dword [eax], ecx
mov eax, dword [ebp - 0x50]
mov word [eax], 0
mov ecx, dword [0x48156c]
mov eax, dword [0x481568]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8028450e
mov ecx, 0xd74db407
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40f898
mov dword [ebp - 0x7c], 0x915647b4
jmp 0x40f898
mov eax, dword [ebp - 0x50]
movzx eax, word [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x7c], 0x9886e9f
jmp 0x40f898
mov eax, dword [ebp - 0x3c]
add eax, 4
add eax, 2
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x7c], 0x3b1574f3
jmp 0x40f898
mov ecx, dword [0x48156c]
mov eax, dword [0x481568]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7f7f38a9
mov ecx, 0x53735e17
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40f898
mov eax, dword [ebp - 0x38]
movzx ecx, word [eax]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x31], al
mov eax, dword [0x48156c]
mov ecx, dword [0x481568]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7f7f38a9
mov ecx, 0x51a1e870
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40f898
mov dl, byte [ebp - 0x31]
mov eax, 0x10ccbf91
mov ecx, 0xf3d62fc2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40f898
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
sub eax, 0x7ebe608e
add eax, 0x18
add eax, 0x7ebe608e
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x7c], 0xffb2d119
jmp 0x40f898
mov ecx, dword [0x48156c]
mov eax, dword [0x481568]
mov edx, ecx
sub edx, 0x297f99ad
sub edx, 1
add edx, 0x297f99ad
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc1fcea2f
mov ecx, 0x3a294c0c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40f898
mov eax, dword [ebp - 0x2c]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0x30]
add ecx, 0x54f902de
add ecx, eax
sub ecx, 0x54f902de
mov eax, dword [ebp - 0x50]
movzx eax, word [eax]
imul edx, eax, 0x28
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x4c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov ecx, dword [0x48156c]
mov eax, dword [0x481568]
mov edx, ecx
add edx, 0xe32a892
sub edx, 1
sub edx, 0xe32a892
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc1fcea2f
mov ecx, 0xf6b52bea
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40f898
mov dword [ebp - 0x7c], 0xac0b6b1
jmp 0x40f898
mov ecx, dword [ebp - 0x28]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x42dd35
call fcn.004229f0
add esp, 8
mov edx, eax
mov eax, 0x8608241e
mov ecx, 0x3f2f1d71
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40f898
mov eax, dword [ebp - 0x48]
mov dword [eax], 0
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
add eax, 0xc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x7c], 0x188bfbf8
jmp 0x40f898
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x20]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x24]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x44]
mov byte [eax], cl
mov eax, dword [ebp - 0x68]
mov edx, dword [eax]
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub edx, 0x2c7dc779
add edx, eax
add edx, 0x2c7dc779
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub ecx, 0xd2be45c9
add ecx, eax
add ecx, 0xd2be45c9
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0041f250
add esp, 0xc
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x68]
mov esi, dword [eax]
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
mov edi, dword [eax + 0xc]
xor eax, eax
sub eax, edi
sub esi, eax
mov eax, dword [ebp - 0x48]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x7c], 0xba1c7bfa
jmp 0x40f898
mov ecx, dword [0x48156c]
mov eax, dword [0x481568]
mov edx, ecx
sub edx, 0x94ceeec7
sub edx, 1
add edx, 0x94ceeec7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x398b370a
mov ecx, 0x15d5c1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40f898
mov eax, dword [ebp - 0x18]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x44]
mov byte [eax], cl
mov ecx, dword [0x48156c]
mov eax, dword [0x481568]
mov edx, ecx
sub edx, 0x23ac9020
sub edx, 1
add edx, 0x23ac9020
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x398b370a
mov ecx, 0x3ad81339
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40f898
mov dword [ebp - 0x7c], 0x3f2f1d71
jmp 0x40f898
mov dword [ebp - 0x7c], 0x17346d3e
jmp 0x40f898
mov eax, dword [ebp - 0x50]
mov ax, word [eax]
mov word [ebp - 0x12], ax
mov dword [ebp - 0x7c], 0xd1135000
jmp 0x40f898
mov ecx, dword [0x48156c]
mov eax, dword [0x481568]
mov edx, ecx
sub edx, 0x8c8bb467
sub edx, 1
add edx, 0x8c8bb467
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe35d6daa
mov ecx, 0x8ad4df88
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40f898
mov cx, word [ebp - 0x12]
xor eax, eax
sub ax, cx
xor ecx, ecx
sub cx, 1
add ax, cx
xor ecx, ecx
sub cx, ax
mov eax, dword [ebp - 0x50]
mov word [eax], cx
mov ecx, dword [0x48156c]
mov eax, dword [0x481568]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe35d6daa
mov ecx, 0x3c73446d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40f898
mov dword [ebp - 0x7c], 0xf259f57e
jmp 0x40f898
mov dword [ebp - 0x7c], 0x915647b4
jmp 0x40f898
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x7c], 0x889af4a3
jmp 0x40f898
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x7c], 0xcefc1bbb
jmp 0x40f898
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e3e0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
mov eax, esp
mov dword [ebp - 0x88], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x84], eax
push eax
mov eax, esp
mov dword [ebp - 0x8c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [ebp - 0x88]
mov edx, eax
mov eax, dword [ebp - 0x84]
mov dword [ecx], edx
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.0041f0f0
add esp, 0xc
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [ebp - 0x8c]
mov edx, dword [ebp - 0x88]
mov esi, eax
mov eax, dword [ebp - 0x84]
mov dword [ecx], esi
mov ecx, dword [ecx]
mov edx, dword [edx]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov dword [ebp - 0x7c], 0xf2665f24
jmp 0x40f898
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x60]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x5c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x58]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
add ecx, 0x61ac63f5
add ecx, eax
sub ecx, 0x61ac63f5
mov eax, dword [ebp - 0x54]
mov dword [eax], ecx
mov eax, dword [ebp - 0x50]
mov word [eax], 0
mov dword [ebp - 0x7c], 0x3638ad7a
jmp 0x40f898
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x7c], 0x53735e17
jmp 0x40f898
mov eax, dword [ebp - 0x2c]
movzx edx, word [eax + 0x14]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x50]
movzx eax, word [eax]
imul edx, eax, 0x28
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x4c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x7c], 0x3a294c0c
jmp 0x40f898
mov eax, dword [ebp - 0x18]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x44]
mov byte [eax], cl
mov dword [ebp - 0x7c], 0x15d5c1
jmp 0x40f898
mov ax, word [ebp - 0x12]
mov cx, word [ebp - 0x12]
add cx, 0xb42e
add cx, 1
sub cx, 0xb42e
mov eax, dword [ebp - 0x50]
mov word [eax], cx
mov dword [ebp - 0x7c], 0x8ad4df88
jmp 0x40ea7e