Function at 0x401f10
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x378
mov eax, dword [0x467be8]
xor eax, esp
mov dword [esp + 0x374], eax
test ebx, ebx
push ebp
mov ebp, dword [esp + 0x380]
mov dword [esp + 0x10], 0
je 0x40223d
mov eax, dword [esp + 0x384]
cmp eax, 0x140
jb 0x40223d
push esi
push edi
mov ecx, 0x10
mov esi, ebx
lea edi, [esp + 0x118]
rep movsd dword es:[edi], dword [esi]
cmp word [esp + 0x118], 0x5a4d
jne 0x40223b
mov edx, dword [esp + 0x154]
lea ecx, [edx + 0x1f8]
cmp ecx, eax
ja 0x40223b
lea esi, [ebx + edx]
mov ecx, 0x3e
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x5c]
test eax, 0x1ff
mov ecx, dword [esp + 0x58]
je 0x401faa
cmp eax, ecx
jne 0x40223b
test eax, eax
je 0x40223b
test ecx, ecx
je 0x40223b
lea ecx, [eax - 1]
test eax, ecx
jne 0x40223b
mov esi, dword [esp + 0x70]
cmp esi, 0x77000000
ja 0x40223b
mov ecx, dword [esp + 0x24]
mov eax, ecx
shr eax, 0x10
cmp ax, 0x60
ja 0x40223b
test cx, cx
mov cx, word [esp + 0x34]
jne 0x401ffb
test cx, cx
je 0x40223b
cmp dword [esp + 0x74], esi
jae 0x40223b
cmp esi, 0x1000000
movzx eax, ax
mov dword [esp + 0x14], eax
ja 0x40223b
movzx ecx, cx
add ecx, ebx
lea ecx, [ecx + edx + 0x18]
lea edx, [eax + eax*4]
lea eax, [ecx + edx*8 + 0x100]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x38c]
lea edx, [ebx + ecx]
cmp eax, edx
ja 0x40223b
push 0x226
lea eax, [esp + 0x15e]
push 0
push eax
mov word [esp + 0x164], 0
call fcn.0043a940
add esp, 0xc
push 0x104
lea ecx, [esp + 0x15c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x158]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.BossKeyHelper.dll
lea eax, [esp + 0x15c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 1
push 0
lea ecx, [esp + 0x160]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4020d5
lea edx, [esp + 0xc]
push edx
push 0x40
push esi
push edi
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push 0
push edi
call fcn.0043a940
add esp, 0xc
jmp 0x4020e7
push 0x40
push 0x3000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
je 0x40223b
mov eax, dword [esp + 0x74]
cmp eax, dword [esp + 0x38c]
ja 0x40223b
push eax
push ebx
push edi
call fcn.0043fc50
mov eax, dword [esp + 0x54]
add eax, edi
add esp, 0xc
cmp dword [esp + 0x14], 0
mov dword [ebp + 0x28], eax
mov dword [esp + 0xc], 0
jle 0x402204
mov esi, dword [esp + 0x10]
add esi, 0x10
mov edi, edi
mov ecx, dword [esi]
mov eax, dword [esi - 4]
lea edx, [eax + ecx]
cmp edx, dword [esp + 0x70]
ja 0x40223b
mov edx, dword [esi + 4]
add edx, ecx
cmp edx, dword [esp + 0x38c]
ja 0x40223b
mov ecx, dword [esi - 8]
push ecx
add eax, edi
push 0
push eax
call fcn.0043a940
mov edx, dword [esi]
mov eax, dword [esi + 4]
mov ecx, dword [esi - 4]
push edx
add eax, ebx
push eax
add ecx, edi
push ecx
call fcn.0043fc50
mov eax, dword [esi]
mov ecx, dword [esi + 4]
add esp, 0x18
lea edx, [esp + 0x10]
push edx
mov edx, dword [esi - 4]
push eax
add ecx, ebx
push ecx
add edx, edi
push edx
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [esi - 8]
mov ecx, dword [esi - 4]
push eax
add ecx, edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea edx, [esi - 0x10]
push str..text
push edx
call fcn.004395a6
add esp, 8
test eax, eax
jne 0x4021e8
cmp dword [ebp + 0x10], 0
mov eax, dword [esi - 8]
jne 0x4021e8
cmp dword [ebp + 0x14], 0
jne 0x4021e8
mov ecx, dword [esi - 4]
add ecx, edi
mov dword [ebp + 0x10], ecx
mov dword [ebp + 0x14], eax
mov eax, dword [esp + 0xc]
add eax, 1
add esi, 0x28
cmp eax, dword [esp + 0x14]
mov dword [esp + 0xc], eax
jl 0x402130
mov esi, dword [esp + 0x70]
test esi, esi
je 0x40223b
push edi
push ebp
call fcn.00401db0
test eax, eax
je 0x40223b
push esi
push edi
call fcn.00401ca0
test eax, eax
je 0x40223b
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov dword [ebp + 8], edi
mov dword [ebp + 0xc], esi
mov dword [esp + 0x18], 1
pop edi
pop esi
mov ecx, dword [esp + 0x378]
mov eax, dword [esp + 0x10]
pop ebp
xor ecx, esp
call fcn.00439112
add esp, 0x378
ret 8