Function at 0x40dd20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x38], 0x38947d87
mov esi, dword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x40dd50
mov dword [ebp - 0x38], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x38]
cmp eax, 0x92109a7c
jg 0x40dd90
cmp eax, 0x891f368a
jne 0x40dd50
call fcn.0040eec0
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
movzx eax, byte [eax]
not eax
or eax, 0xfffffffc
cmp eax, 0xffffffff
mov eax, 0x6cc69e5c
jne 0x40dd3e
mov eax, 0xbe2396e1
jmp 0x40dd3e
cmp eax, 0x96176cc5
jg 0x40ddc0
cmp eax, 0x92109a7d
jne 0x40dd50
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov dword [ebp - 0x38], 0x75619bb2
jmp 0x40dd50
cmp eax, 0x77d264ac
jg 0x40ded4
cmp eax, 0x75619bb1
jg 0x40dfe5
cmp eax, 0x709a5ae3
jg 0x40e011
cmp eax, 0x6cc69e5b
jg 0x40e035
cmp eax, 0x6677fcdc
jg 0x40e097
cmp eax, 0x562d94b1
jg 0x40e0a7
cmp eax, 0x50f3aa2d
jg 0x40e0e2
cmp eax, 0x4b9de14d
jg 0x40e103
cmp eax, 0x49c4d3bf
jg 0x40e11a
cmp eax, 0x43816a0c
jg 0x40e131
cmp eax, 0x38947d86
jg 0x40e156
cmp eax, 0x334add16
jg 0x40e16d
cmp eax, 0xd98f32c
jg 0x40e18d
cmp eax, 0xf41ab295
jg 0x40e1ad
cmp eax, 0xf1712d6f
jg 0x40e1c4
cmp eax, 0xec76a117
jg 0x40e1db
cmp eax, 0xe0e33901
jg 0x40e228
cmp eax, 0xc28ac948
jg 0x40e308
cmp eax, 0xbe2396e0
jg 0x40e328
cmp eax, 0xbb1f5848
jg 0x40e33f
cmp eax, 0xb44de2a5
jg 0x40e360
cmp eax, 0xb05f94e5
jg 0x40e37d
cmp eax, 0x9749fac8
jg 0x40e3e7
cmp eax, 0x96176cc6
jne 0x40dd50
mov dword [ebp - 0x38], 0x43816a0d
jmp 0x40dd50
cmp eax, 0x77d264ad
jne 0x40dd50
mov eax, 4
call fcn.00417020
mov dword [ebp - 0x34], esp
mov eax, 4
call fcn.00417020
mov dword [ebp - 0x30], esp
mov eax, 4
call fcn.00417020
mov dword [ebp - 0x2c], esp
mov eax, 4
call fcn.00417020
mov dword [ebp - 0x28], esp
mov eax, 4
call fcn.00417020
mov dword [ebp - 0x24], esp
mov eax, 4
call fcn.00417020
mov dword [ebp - 0x20], esp
mov eax, 4
call fcn.00417020
mov dword [ebp - 0x1c], esp
mov eax, 4
call fcn.00417020
mov dword [ebp - 0x18], esp
mov eax, 4
call fcn.00417020
mov dword [ebp - 0x14], esp
mov eax, dword [ebp - 0x30]
mov dword [eax], edi
mov eax, dword [ebp - 0x2c]
mov dword [eax], ebx
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx]
add eax, dword [ecx + 0x11]
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx]
add eax, dword [ecx + 0x15]
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov eax, dword [eax + 5]
sub esp, 0x10
mov dword [esp + 4], eax
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 0
setne byte [ebp - 0xe]
mov dword [ebp - 0x38], 0xa0d7976e
jmp 0x40dd50
cmp eax, 0x75619bb2
jne 0x40dd50
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x28]
mov edx, dword [eax]
mov eax, 0xb05f94e6
cmp ecx, dword [edx + 0xd]
jb 0x40e009
mov eax, 0xabc88b0e
mov dword [ebp - 0x38], eax
jmp 0x40dd50
cmp eax, 0x709a5ae4
jne 0x40dd50
mov al, byte [ebp - 0xd]
test al, al
mov eax, 0x96176cc6
jne 0x40e02d
mov eax, 0x49c4d3c0
mov dword [ebp - 0x38], eax
jmp 0x40dd50
cmp eax, 0x6cc69e5c
jne 0x40dd50
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx]
mov edx, 0xd6b7e5de
sub edx, dword [ecx + 1]
lea eax, [edx + eax + 0x29481a22]
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx]
add eax, dword [ecx + 0x19]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call fcn.0040ced0
add esp, 0xc
mov dword [ebp - 0x38], 0xbe2396e1
jmp 0x40dd50
cmp eax, 0x6677fcdd
jne 0x40dd50
jmp 0x40e4dd
cmp eax, 0x562d94b2
jne 0x40dd50
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx]
add eax, dword [ecx + 1]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.0040c810
add esp, 8
mov dword [ebp - 0x38], 0x891f368a
jmp 0x40dd50
cmp eax, 0x50f3aa2e
jne 0x40dd50
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x34]
mov dword [ecx], eax
mov dword [ebp - 0x38], 0xbb1f5849
jmp 0x40dd50
cmp eax, 0x4b9de14e
jne 0x40dd50
mov dword [ebp - 0x38], 0x6677fcdd
jmp 0x40dd50
cmp eax, 0x49c4d3c0
jne 0x40dd50
mov dword [ebp - 0x38], 0xbb1f5849
jmp 0x40dd50
cmp eax, 0x43816a0d
jne 0x40dd50
mov ecx, dword [ebp - 0x1c]
mov eax, 0xab89fc31
cmp dword [ecx], 0
jne 0x40e14e
mov eax, 0xd98f32d
mov dword [ebp - 0x38], eax
jmp 0x40dd50
cmp eax, 0x38947d87
jne 0x40dd50
mov dword [ebp - 0x38], 0x77d264ad
jmp 0x40dd50
cmp eax, 0x334add17
jne 0x40dd50
mov eax, dword [ebp - 0x18]
mov dword [eax], 0
mov dword [ebp - 0x38], 0xf41ab296
jmp 0x40dd50
cmp eax, 0xd98f32d
jne 0x40dd50
mov eax, dword [ebp - 0x34]
mov dword [eax], 0
mov dword [ebp - 0x38], 0x6677fcdd
jmp 0x40dd50
cmp eax, 0xf41ab296
jne 0x40dd50
mov dword [ebp - 0x38], 0x75619bb2
jmp 0x40dd50
cmp eax, 0xf1712d70
jne 0x40dd50
mov dword [ebp - 0x38], 0x334add17
jmp 0x40dd50
cmp eax, 0xec76a118
jne 0x40dd50
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx]
add eax, dword [ecx + 0x11]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xd]
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call fcn.0040d5b0
add esp, 0xc
test eax, eax
sets byte [ebp - 0xd]
mov dword [ebp - 0x38], 0x709a5ae4
jmp 0x40dd50
cmp eax, 0xe0e33902
jne 0x40dd50
mov eax, 4
call fcn.00417020
mov eax, 4
call fcn.00417020
mov dword [ebp - 0x40], esp
mov eax, 4
call fcn.00417020
mov edx, esp
mov eax, 4
call fcn.00417020
mov esi, esp
mov eax, 4
call fcn.00417020
mov ecx, esp
mov eax, 4
call fcn.00417020
mov dword [ebp - 0x44], esp
mov eax, 4
call fcn.00417020
mov dword [ebp - 0x3c], esp
mov eax, 4
call fcn.00417020
mov eax, 4
call fcn.00417020
mov eax, dword [ebp - 0x40]
mov dword [eax], edi
mov dword [edx], ebx
mov dword [esi], ebx
mov eax, dword [edx]
add eax, dword [ebx + 0x11]
mov dword [ecx], eax
mov eax, dword [edx]
mov ecx, dword [esi]
add eax, dword [ecx + 0x15]
mov ecx, dword [ebp - 0x44]
mov dword [ecx], eax
mov eax, dword [ebp - 0x3c]
mov dword [eax], 0
mov dword [esp], 0
mov eax, dword [esi]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseEventLog]
mov eax, dword [eax + 5]
sub esp, 0x10
mov dword [esp + 4], eax
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], eax
mov dword [ebp - 0x38], 0x77d264ad
jmp 0x40dd50
cmp eax, 0xc28ac949
jne 0x40dd50
mov eax, dword [ebp - 0x18]
mov dword [eax], 0
mov dword [ebp - 0x38], 0x334add17
jmp 0x40dd50
cmp eax, 0xbe2396e1
jne 0x40dd50
mov dword [ebp - 0x38], 0xec76a118
jmp 0x40dd50
cmp eax, 0xbb1f5849
jne 0x40dd50
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x34]
mov dword [ecx], eax
mov dword [ebp - 0x38], 0x4b9de14e
jmp 0x40dd50
cmp eax, 0xb44de2a6
jne 0x40dd50
mov eax, esi
mov esi, dword [eax]
mov esi, eax
mov dword [ebp - 0x38], 0x43816a0d
jmp 0x40dd50
cmp eax, 0xb05f94e6
jne 0x40dd50
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov eax, dword [eax + 5]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx]
add ecx, 0xd
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx]
mov eax, esi
mov esi, dword [ebp - 0x24]
mov esi, dword [esi]
add edx, dword [esi + 1]
mov esi, eax
sub esp, 0xc
mov eax, dword [ebp - 0x3c]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call fcn.00402cc0
add esp, 0xc
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 5]
lea eax, [eax + ecx + 0xd]
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
mov dword [ebp - 0x38], 0x92109a7d
jmp 0x40dd50
cmp eax, 0xa0d7976d
jg 0x40e435
cmp eax, 0x9749fac9
jne 0x40dd50
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx]
add eax, dword [ecx + 0x11]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xd]
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call fcn.0040d5b0
add esp, 0xc
mov dword [ebp - 0x38], 0xec76a118
jmp 0x40dd50
cmp eax, 0xa0d7976e
je 0x40e470
cmp eax, 0xab89fc31
jne 0x40e489
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [ebp - 0x38], 0xd98f32d
jmp 0x40dd50
mov al, byte [ebp - 0xe]
test al, al
mov eax, 0xf1712d70
jne 0x40e481
mov eax, 0xb44de2a6
mov dword [ebp - 0x38], eax
jmp 0x40dd50
cmp eax, 0xabc88b0e
jne 0x40dd50
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 8], 0x20
call fcn.00402cc0
add esp, 0xc
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
movzx eax, byte [eax]
not eax
or eax, 0xfffffffe
cmp eax, 0xffffffff
mov eax, 0x562d94b2
jne 0x40e4d5
mov eax, 0x891f368a
mov dword [ebp - 0x38], eax
jmp 0x40dd50
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret