Function at 0x40deb0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x94
mov eax, dword [0x47f880]
xor eax, ebp
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x7c], 0xa7199456
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x80], eax
sub eax, 0x801ed202
je 0x40ea98
jmp 0x40deeb
mov eax, dword [ebp - 0x80]
sub eax, 0x82cce4fa
je 0x40eba5
jmp 0x40defe
mov eax, dword [ebp - 0x80]
sub eax, 0x99bafdff
je 0x40e694
jmp 0x40df11
mov eax, dword [ebp - 0x80]
sub eax, 0x9d70d057
je 0x40e465
jmp 0x40df24
mov eax, dword [ebp - 0x80]
sub eax, 0xa7199456
je 0x40e1fb
jmp 0x40df37
mov eax, dword [ebp - 0x80]
sub eax, 0xa8f611c3
je 0x40e9e4
jmp 0x40df4a
mov eax, dword [ebp - 0x80]
sub eax, 0xaac78f50
je 0x40e549
jmp 0x40df5d
mov eax, dword [ebp - 0x80]
sub eax, 0xb2ee21dc
je 0x40e52e
jmp 0x40df70
mov eax, dword [ebp - 0x80]
sub eax, 0xb742656a
je 0x40e912
jmp 0x40df83
mov eax, dword [ebp - 0x80]
sub eax, 0xb7dfd147
je 0x40e823
jmp 0x40df96
mov eax, dword [ebp - 0x80]
sub eax, 0xc1c18e0c
je 0x40e26e
jmp 0x40dfa9
mov eax, dword [ebp - 0x80]
sub eax, 0xc580b3e8
je 0x40ea8c
jmp 0x40dfbc
mov eax, dword [ebp - 0x80]
sub eax, 0xcf1b7fea
je 0x40ebb9
jmp 0x40dfcf
mov eax, dword [ebp - 0x80]
sub eax, 0xd5145156
je 0x40eadd
jmp 0x40dfe2
mov eax, dword [ebp - 0x80]
sub eax, 0xd62525a8
je 0x40eb2b
jmp 0x40dff5
mov eax, dword [ebp - 0x80]
sub eax, 0xd82782f1
je 0x40e6ff
jmp 0x40e008
mov eax, dword [ebp - 0x80]
sub eax, 0xdf5d579a
je 0x40ed47
jmp 0x40e01b
mov eax, dword [ebp - 0x80]
sub eax, 0xe04fbc83
je 0x40e985
jmp 0x40e02e
mov eax, dword [ebp - 0x80]
sub eax, 0xea5da127
je 0x40ea3e
jmp 0x40e041
mov eax, dword [ebp - 0x80]
sub eax, 0xf2a47a6f
je 0x40e85e
jmp 0x40e054
mov eax, dword [ebp - 0x80]
sub eax, 0xf3bf9c0f
je 0x40e64e
jmp 0x40e067
mov eax, dword [ebp - 0x80]
sub eax, 0xf611dad7
je 0x40ecde
jmp 0x40e07a
mov eax, dword [ebp - 0x80]
sub eax, 0x8b2059d
je 0x40ed53
jmp 0x40e08d
mov eax, dword [ebp - 0x80]
sub eax, 0x94ce8c5
je 0x40ecf0
jmp 0x40e0a0
mov eax, dword [ebp - 0x80]
sub eax, 0xa7ef177
je 0x40e786
jmp 0x40e0b3
mov eax, dword [ebp - 0x80]
sub eax, 0xb17a601
je 0x40e436
jmp 0x40e0c6
mov eax, dword [ebp - 0x80]
sub eax, 0x102016bf
je 0x40e5ce
jmp 0x40e0d9
mov eax, dword [ebp - 0x80]
sub eax, 0x152c2730
je 0x40e44f
jmp 0x40e0ec
mov eax, dword [ebp - 0x80]
sub eax, 0x2ad083b8
je 0x40e8f2
jmp 0x40e0ff
mov eax, dword [ebp - 0x80]
sub eax, 0x4226bbb7
je 0x40ed1e
jmp 0x40e112
mov eax, dword [ebp - 0x80]
sub eax, 0x42ab7d06
je 0x40e40c
jmp 0x40e125
mov eax, dword [ebp - 0x80]
sub eax, 0x4c188244
je 0x40e4b3
jmp 0x40e138
mov eax, dword [ebp - 0x80]
sub eax, 0x4f171917
je 0x40e55b
jmp 0x40e14b
mov eax, dword [ebp - 0x80]
sub eax, 0x567fa7aa
je 0x40e8a4
jmp 0x40e15e
mov eax, dword [ebp - 0x80]
sub eax, 0x617b523c
je 0x40ed12
jmp 0x40e171
mov eax, dword [ebp - 0x80]
sub eax, 0x6a2a7b51
je 0x40e400
jmp 0x40e184
mov eax, dword [ebp - 0x80]
sub eax, 0x6ba8b73a
je 0x40e642
jmp 0x40e197
mov eax, dword [ebp - 0x80]
sub eax, 0x7340939d
je 0x40ecff
jmp 0x40e1aa
mov eax, dword [ebp - 0x80]
sub eax, 0x75370337
je 0x40e9f0
jmp 0x40e1bd
mov eax, dword [ebp - 0x80]
sub eax, 0x77c88d8b
je 0x40e77a
jmp 0x40e1d0
mov eax, dword [ebp - 0x80]
sub eax, 0x78e7b46e
je 0x40e8fe
jmp 0x40e1e3
mov eax, dword [ebp - 0x80]
sub eax, 0x7e549889
je 0x40eab3
jmp 0x40e1f6
jmp 0x40ed69
mov ecx, dword [0x480d34]
mov eax, dword [0x480d30]
mov edx, ecx
sub edx, 0xdcb5c32e
sub edx, 1
add edx, 0xdcb5c32e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xcf1b7fea
mov ecx, 0xc1c18e0c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40ed69
lea eax, [ebp - 0x18]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.0041e6d0
lea eax, [0x42dd88]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub esp, 4
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x50]
lea eax, [ebp - 0x18]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
sub esp, 0x10
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x58], eax
lea eax, str.c:windows_system32_ntdll.dll
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
sub esp, 0x18
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
sub esp, 0x14
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x4c], eax
mov ecx, dword [0x480d34]
mov eax, dword [0x480d30]
mov edx, ecx
sub edx, 0xd87d3a7a
sub edx, 1
add edx, 0xd87d3a7a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xcf1b7fea
mov ecx, 0x6a2a7b51
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40ed69
mov dword [ebp - 0x7c], 0x42ab7d06
jmp 0x40ed69
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x68]
mov ecx, dword [ecx + 0x3c]
add eax, 0x101a9219
add eax, ecx
sub eax, 0x101a9219
mov dword [ebp - 0x6c], eax
mov word [ebp - 0x6e], 0
mov dword [ebp - 0x7c], 0xb17a601
jmp 0x40ed69
movzx eax, word [ebp - 0x6e]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x7c], 0x152c2730
jmp 0x40ed69
mov eax, dword [ebp - 0x44]
movzx eax, word [eax + 6]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x7c], 0x9d70d057
jmp 0x40ed69
mov eax, dword [0x480d34]
mov ecx, dword [0x480d30]
mov edx, eax
sub edx, 0x8cd35980
sub edx, 1
add edx, 0x8cd35980
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf611dad7
mov ecx, 0x4c188244
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40ed69
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x40]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x39], al
mov ecx, dword [0x480d34]
mov eax, dword [0x480d30]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf611dad7
mov ecx, 0xb2ee21dc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40ed69
mov dl, byte [ebp - 0x39]
mov eax, 0x801ed202
mov ecx, 0xaac78f50
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40ed69
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x7c], 0x4f171917
jmp 0x40ed69
mov ecx, dword [0x480d34]
mov eax, dword [0x480d30]
mov edx, ecx
add edx, 0xbba5c77c
sub edx, 1
sub edx, 0xbba5c77c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x94ce8c5
mov ecx, 0x102016bf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40ed69
mov eax, dword [ebp - 0x38]
add eax, 0x8b654c59
add eax, 0x18
sub eax, 0x8b654c59
mov ecx, dword [ebp - 0x6c]
movzx ecx, word [ecx + 0x14]
sub eax, 0xac2dda3e
add eax, ecx
add eax, 0xac2dda3e
mov dword [ebp - 0x34], eax
mov eax, dword [0x480d34]
mov ecx, dword [0x480d30]
mov edx, eax
add edx, 0xb5fa3409
sub edx, 1
sub edx, 0xb5fa3409
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x94ce8c5
mov ecx, 0x6ba8b73a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40ed69
mov dword [ebp - 0x7c], 0xf3bf9c0f
jmp 0x40ed69
mov eax, dword [ebp - 0x34]
movzx ecx, word [ebp - 0x6e]
imul ecx, ecx, 0x28
sub eax, 0xce2eb750
add eax, ecx
add eax, 0xce2eb750
mov dword [ebp - 0x74], eax
mov ecx, dword [ebp - 0x74]
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x42ddb0
call fcn.00421fd0
mov edx, eax
mov eax, 0x99bafdff
mov ecx, 0xf2a47a6f
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40ed69
mov ecx, dword [0x480d34]
mov eax, dword [0x480d30]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7340939d
mov ecx, 0xd82782f1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40ed69
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 8]
mov dword [ebp - 0x30], eax
mov ecx, dword [0x480d34]
mov eax, dword [0x480d30]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7340939d
mov ecx, 0x77c88d8b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40ed69
mov dword [ebp - 0x7c], 0xa7ef177
jmp 0x40ed69
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
sub edx, eax
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x1c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x75], al
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
sub edx, eax
mov ecx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x74]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub ecx, eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 8]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0041e830
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x74]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x7c], 0xb7dfd147
jmp 0x40ed69
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x24]
lea eax, [ebp - 0x1c]
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x75], al
mov dword [ebp - 0x7c], 0xf2a47a6f
jmp 0x40ed69
mov eax, dword [0x480d34]
mov ecx, dword [0x480d30]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x617b523c
mov ecx, 0x567fa7aa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40ed69
mov eax, dword [0x480d34]
mov ecx, dword [0x480d30]
mov edx, eax
sub edx, 0x8e991188
sub edx, 1
add edx, 0x8e991188
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x617b523c
mov ecx, 0x2ad083b8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40ed69
mov dword [ebp - 0x7c], 0x78e7b46e
jmp 0x40ed69
mov ax, word [ebp - 0x6e]
mov word [ebp - 0x1e], ax
mov dword [ebp - 0x7c], 0xb742656a
jmp 0x40ed69
mov ecx, dword [0x480d34]
mov eax, dword [0x480d30]
mov edx, ecx
sub edx, 0xb9e604aa
sub edx, 1
add edx, 0xb9e604aa
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4226bbb7
mov ecx, 0xe04fbc83
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40ed69
mov ax, word [ebp - 0x1e]
xor ecx, ecx
sub cx, 1
sub ax, cx
mov word [ebp - 0x6e], ax
mov eax, dword [0x480d34]
mov ecx, dword [0x480d30]
mov edx, eax
add edx, 0x555ba366
sub edx, 1
sub edx, 0x555ba366
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4226bbb7
mov ecx, 0xa8f611c3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40ed69
mov dword [ebp - 0x7c], 0x75370337
jmp 0x40ed69
mov eax, dword [0x480d34]
mov ecx, dword [0x480d30]
mov edx, eax
sub edx, 0x5cc2b04f
sub edx, 1
add edx, 0x5cc2b04f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdf5d579a
mov ecx, 0xea5da127
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40ed69
mov eax, dword [0x480d34]
mov ecx, dword [0x480d30]
mov edx, eax
add edx, 0x2078af19
sub edx, 1
sub edx, 0x2078af19
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdf5d579a
mov ecx, 0xc580b3e8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40ed69
mov dword [ebp - 0x7c], 0xb17a601
jmp 0x40ed69
mov eax, dword [ebp - 0x50]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x7c], 0x7e549889
jmp 0x40ed69
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x7c], 0xd5145156
jmp 0x40ed69
mov eax, dword [0x480d34]
mov ecx, dword [0x480d30]
mov edx, eax
add edx, 0x45bba6b8
sub edx, 1
sub edx, 0x45bba6b8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8b2059d
mov ecx, 0xd62525a8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40ed69
mov eax, dword [ebp - 0x54]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esp, 4
mov ecx, dword [0x480d34]
mov eax, dword [0x480d30]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8b2059d
mov ecx, 0x82cce4fa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x40ed69
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0041d9e0
add esp, 0x94
pop esi
pop ebx
pop ebp
ret
lea eax, [ebp - 0x18]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.0041e6d0
lea eax, [0x42dd88]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub esp, 4
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x50]
lea eax, [ebp - 0x18]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
sub esp, 0x10
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x58], eax
lea eax, str.c:windows_system32_ntdll.dll
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
sub esp, 0x18
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
sub esp, 0x14
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x7c], 0xc1c18e0c
jmp 0x40ed69
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x7c], 0x4c188244
jmp 0x40ed69
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x7c], 0x102016bf
jmp 0x40ed69
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x7c], 0xd82782f1
jmp 0x40ed69
mov dword [ebp - 0x7c], 0x567fa7aa
jmp 0x40ed69
mov ax, word [ebp - 0x1e]
mov ax, word [ebp - 0x1e]
mov ax, word [ebp - 0x1e]
mov ax, word [ebp - 0x1e]
xor ecx, ecx
sub cx, 1
sub ax, cx
mov word [ebp - 0x6e], ax
mov dword [ebp - 0x7c], 0xe04fbc83
jmp 0x40ed69
mov dword [ebp - 0x7c], 0xea5da127
jmp 0x40ed69
mov eax, dword [ebp - 0x54]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esp, 4
mov dword [ebp - 0x7c], 0xd62525a8
jmp 0x40ded5