Function at 0x41e7b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
call fcn.0041f32c
push 0x6d5268
mov ebx, dword [ebp + 0x10]
push dword [ebx]
call fcn.00401238
add esp, 8
cmp eax, 0
je 0x41e8f1
push 0x80000301
push 0
push 1
push OleUIBusyA
push 0
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebx]
test eax, eax
jne 0x41e847
mov eax, 0x6d5268
push eax
push 2
mov ebx, 0x480020
call fcn.0047f8ff
add esp, 0x1c
mov dword [ebp - 0x30], eax
push 0x6eb210
push dword [ebp - 0x30]
call fcn.00401238
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x34], eax
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x41e88b
push ebx
call fcn.0047f8ed
add esp, 4
cmp dword [ebp - 0x34], 0
je 0x41e89f
mov eax, 0x6d5268
jmp 0x41e8a4
mov eax, 0x6eb210
mov dword [ebp - 0x38], eax
mov ebx, dword [ebp + 0xc]
push dword [ebx]
push dword [ebp - 0x38]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
mov ecx, 3
call fcn.00401bb0
add esp, 0xc
mov dword [ebp - 0x3c], eax
mov ebx, dword [ebp - 0x38]
test ebx, ebx
je 0x41e8d4
push ebx
call fcn.0047f8ed
add esp, 4
mov eax, dword [ebp - 0x3c]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41e8e8
push ebx
call fcn.0047f8ed
add esp, 4
pop eax
mov dword [ebp - 4], eax
jmp 0x41e94b
push 0
mov ebx, 0x47fe60
call fcn.0047f8ff
add esp, 4
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp + 0xc]
push dword [ebx]
push 0x6eb210
push dword [ebp - 0x30]
mov ecx, 3
call fcn.00401bb0
add esp, 0xc
mov dword [ebp - 0x34], eax
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x41e933
push ebx
call fcn.0047f8ed
add esp, 4
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41e947
push ebx
call fcn.0047f8ed
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], esp
push dword [ebp - 4]
call sub.KERNEL32.dll_GetModuleHandleA_1
cmp dword [ebp - 0x30], esp
je 0x41e972
push 0x19c
push 0x4027fae
push 6
call fcn.0047f8f3
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x41e987
mov eax, dword [ebp - 8]
jmp 0x41f313
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call fcn.0041f3e4
cdq
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0x10], 0
jne 0x41e9a4
cmp dword [ebp - 0xc], 0
jne 0x41e9b4
mov eax, 0
jmp 0x41f313
mov dword [ebp - 0x30], esp
push 0x40
push 0x1000
push 0x200
push 0
call sub.KERNEL32.dll_VirtualAlloc_1
cmp dword [ebp - 0x30], esp
je 0x41e9ec
push 0x302
push 0x4027fae
push 6
call fcn.0047f8f3
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x41ea03
mov eax, 0
jmp 0x41f313
mov dword [ebp - 0x30], esp
push 0x6ebfc4
call sub.KERNEL32.dll_LoadLibraryA_1
cmp dword [ebp - 0x30], esp
je 0x41ea2c
push 0x3f4
push 0x4027fae
push 6
call fcn.0047f8f3
add esp, 0xc
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], esp
push 0x934ccc
push dword [ebp - 0x34]
call sub.KERNEL32.dll_GetProcAddress_1
cmp dword [ebp - 0x38], esp
je 0x41ea5b
push 0x3f4
push 0x4027fae
push 6
call fcn.0047f8f3
add esp, 0xc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x30], esp
push 0x6ebf88
call sub.KERNEL32.dll_LoadLibraryA_1
cmp dword [ebp - 0x30], esp
je 0x41ea87
push 0x45a
push 0x4027fae
push 6
call fcn.0047f8f3
add esp, 0xc
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], esp
push 0x934cdc
push dword [ebp - 0x34]
call sub.KERNEL32.dll_GetProcAddress_1
cmp dword [ebp - 0x38], esp
je 0x41eab6
push 0x45a
push 0x4027fae
push 6
call fcn.0047f8f3
add esp, 0xc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], esp
push dword [0xab17ec]
mov eax, 0x2b
call fcn.0047f905
cmp dword [ebp - 0x30], esp
je 0x41eae8
push 0x4ca
push 0x4027fae
push 6
call fcn.0047f8f3
add esp, 0xc
cmp dword [0xab17f0], 0
je 0x41eb67
mov dword [ebp - 0x30], esp
call sub.KERNEL32.dll_GetProcessHeap_1
cmp dword [ebp - 0x30], esp
je 0x41eb19
push 0x566
push 0x4027fae
push 6
call fcn.0047f8f3
add esp, 0xc
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], esp
push dword [0xab17f0]
push 0
push dword [ebp - 0x34]
mov eax, 0x2c
call fcn.0047f905
cmp dword [ebp - 0x38], esp
je 0x41eb53
push 0x566
push 0x4027fae
push 6
call fcn.0047f8f3
add esp, 0xc
mov dword [0xab17f0], 0
mov dword [0xab17f4], 0
push dword [ebp - 4]
push 0x934cec
mov ecx, 2
call fcn.00401bb0
add esp, 8
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], 0
push 0
push dword [ebp - 0x34]
push 0xab17f4
lea eax, [ebp - 0x30]
push eax
call fcn.0041f43c
mov dword [ebp - 0x38], eax
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x41ebac
push ebx
call fcn.0047f8ed
add esp, 4
mov eax, dword [ebp - 0x38]
mov dword [0xab17f0], eax
mov eax, dword [ebp + 0x18]
mov dword [0xab17f8], eax
push dword [ebp - 0x18]
push 0x42028a
mov eax, 0x934cf4
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
push 0xab17fc
call fcn.0041f630
mov dword [ebp - 0x34], eax
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x41ebed
push ebx
call fcn.0047f8ed
add esp, 4
cmp dword [ebp - 0x34], 0
jne 0x41ebfc
jmp 0x41f229
fild dword [ebp - 0x18]
fstp qword [ebp - 0x34]
fld qword [ebp - 0x34]
fadd qword [0x97d080]
fstp qword [ebp - 0x3c]
fld qword [ebp - 0x3c]
call fcn.00401fac
push eax
push 0x4203aa
mov eax, 0x934d0c
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x40]
push eax
push 0xab1800
call fcn.0041f630
mov dword [ebp - 0x44], eax
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x41ec45
push ebx
call fcn.0047f8ed
add esp, 4
cmp dword [ebp - 0x44], 0
jne 0x41ec54
jmp 0x41f229
fild dword [ebp - 0x18]
fstp qword [ebp - 0x34]
fld qword [ebp - 0x34]
fadd qword [0x97d088]
fstp qword [ebp - 0x3c]
fld qword [ebp - 0x3c]
call fcn.00401fac
push eax
push 0x420447
mov eax, 0x934d18
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x40]
push eax
push 0xab1804
call fcn.0041f630
mov dword [ebp - 0x44], eax
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x41ec9d
push ebx
call fcn.0047f8ed
add esp, 4
cmp dword [ebp - 0x44], 0
jne 0x41ecac
jmp 0x41f229
fild dword [ebp - 0x18]
fstp qword [ebp - 0x34]
fld qword [ebp - 0x34]
fadd qword [0x97d090]
fstp qword [ebp - 0x3c]
fld qword [ebp - 0x3c]
call fcn.00401fac
push eax
push 0x42051b
mov eax, str.NtMapViewOfSection
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x40]
push eax
push 0xab1808
call fcn.0041f630
mov dword [ebp - 0x44], eax
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x41ecf5
push ebx
call fcn.0047f8ed
add esp, 4
cmp dword [ebp - 0x44], 0
jne 0x41ed04
jmp 0x41f229
fild dword [ebp - 0x18]
fstp qword [ebp - 0x34]
fld qword [ebp - 0x34]
fadd qword [0x97d098]
fstp qword [ebp - 0x3c]
fld qword [ebp - 0x3c]
call fcn.00401fac
push eax
push 0x42059e
mov eax, 0x934d3c
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x40]
push eax
push 0xab180c
call fcn.0041f630
mov dword [ebp - 0x44], eax
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x41ed4d
push ebx
call fcn.0047f8ed
add esp, 4
cmp dword [ebp - 0x44], 0
jne 0x41ed5c
jmp 0x41f229
cmp dword [ebp + 0x18], 0
je 0x41ef58
fild dword [ebp - 0x18]
fstp qword [ebp - 0x34]
fld qword [ebp - 0x34]
fadd qword [0x97d0a0]
fstp qword [ebp - 0x3c]
fld qword [ebp - 0x3c]
call fcn.00401fac
push eax
push 0x420716
mov eax, str.NtCreateFile
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x40]
push eax
push 0xab1810
call fcn.0041f630
mov dword [ebp - 0x44], eax
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x41edaf
push ebx
call fcn.0047f8ed
add esp, 4
cmp dword [ebp - 0x44], 0
jne 0x41edbe
jmp 0x41f229
fild dword [ebp - 0x18]
fstp qword [ebp - 0x34]
fld qword [ebp - 0x34]
fadd qword [0x97d0a8]
fstp qword [ebp - 0x3c]
fld qword [ebp - 0x3c]
call fcn.00401fac
push eax
push 0x420852
mov eax, 0x934d54
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x40]
push eax
push 0xab1814
call fcn.0041f630
mov dword [ebp - 0x44], eax
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x41ee07
push ebx
call fcn.0047f8ed
add esp, 4
cmp dword [ebp - 0x44], 0
jne 0x41ee16
jmp 0x41f229
fild dword [ebp - 0x18]
fstp qword [ebp - 0x34]
fld qword [ebp - 0x34]
fadd qword [0x97d0b0]
fstp qword [ebp - 0x3c]
fld qword [ebp - 0x3c]
call fcn.00401fac
push eax
push 0x420a3e
mov eax, str.NtQueryInformationFile
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x40]
push eax
push 0xab1818
call fcn.0041f630
mov dword [ebp - 0x44], eax
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x41ee5f
push ebx
call fcn.0047f8ed
add esp, 4
cmp dword [ebp - 0x44], 0
jne 0x41ee6e
jmp 0x41f229
fild dword [ebp - 0x18]
fstp qword [ebp - 0x34]
fld qword [ebp - 0x34]
fadd qword [0x97d0b8]
fstp qword [ebp - 0x3c]
fld qword [ebp - 0x3c]
call fcn.00401fac
push eax
push 0x420b72
mov eax, str.NtSetInformationFile
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x40]
push eax
push 0xab181c
call fcn.0041f630
mov dword [ebp - 0x44], eax
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x41eeb7
push ebx
call fcn.0047f8ed
add esp, 4
cmp dword [ebp - 0x44], 0
jne 0x41eec6
jmp 0x41f229
fild dword [ebp - 0x18]
fstp qword [ebp - 0x34]
fld qword [ebp - 0x34]
fadd qword [0x97d0c0]
fstp qword [ebp - 0x3c]
fld qword [ebp - 0x3c]
call fcn.00401fac
push eax
push 0x420d12
mov eax, 0x934da4
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x40]
push eax
push 0xab1820
call fcn.0041f630
mov dword [ebp - 0x44], eax
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x41ef0f
push ebx
call fcn.0047f8ed
add esp, 4
cmp dword [ebp - 0x44], 0
jne 0x41ef1e
jmp 0x41f229
push dword [ebp + 8]
call fcn.0041fe48
mov dword [0xab1824], eax
push reloc.WS2_32.dll_getpeername
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x41ef40
mov eax, 0x6d53c0
push eax
push 1
mov ebx, 0x47fe40
call fcn.0047f8ff
add esp, 0x10
mov dword [0xab1828], eax
mov ebx, dword [0xab1804]
add ebx, 4
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0x10]
push eax
call fcn.0041fe6c
mov dword [ebp - 0x34], eax
push 0
push 0x8000000
push 0x40
push dword [ebp - 0x34]
push 0
push 0xe
push 0xab182c
mov ebx, dword [ebp - 0x30]
push dword [ebx]
call fcn.0041fe88
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x41efad
jmp 0x41f229
mov eax, dword [ebp - 0x14]
mov dword [0xab1830], eax
mov dword [0xab1834], 0
mov ebx, dword [0xab1808]
add ebx, 4
mov dword [ebp - 0x30], ebx
push 0x40
push 0
push 2
push 0xab1834
push 0
push 0
push 0
push 0xab1830
push 0xffffffff
push dword [0xab182c]
mov ebx, dword [ebp - 0x30]
push dword [ebx]
call fcn.0041fea8
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xc0000018
jne 0x41f06e
mov dword [0xab1830], 0
mov ebx, dword [0xab1808]
add ebx, 4
mov dword [ebp - 0x30], ebx
push 0x40
push 0
push 2
push 0xab1834
push 0
push 0
push 0
push 0xab1830
push 0xffffffff
push dword [0xab182c]
mov ebx, dword [ebp - 0x30]
push dword [ebx]
call fcn.0041fea8
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x41f099
mov ebx, dword [0xab180c]
add ebx, 4
mov dword [ebp - 0x30], ebx
push dword [0xab182c]
mov ebx, dword [ebp - 0x30]
push dword [ebx]
call fcn.0041fec8
jmp 0x41f229
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push dword [0xab1830]
push dword [ebp + 8]
call fcn.0041fbbc
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x41f10f
mov ebx, dword [0xab180c]
add ebx, 4
mov dword [ebp - 0x30], ebx
push dword [0xab182c]
mov ebx, dword [ebp - 0x30]
push dword [ebx]
call fcn.0041fec8
mov dword [ebp - 0x30], esp
push dword [0xab1830]
push 0xffffffff
mov eax, 0x2d
call fcn.0047f905
cmp dword [ebp - 0x30], esp
je 0x41f10a
push 0x1154
push 0x4027fae
push 6
call fcn.0047f8f3
add esp, 0xc
jmp 0x41f229
mov dword [ebp - 0x30], esp
push dword [ebp - 4]
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x2e
call fcn.0047f905
cmp dword [ebp - 0x30], esp
je 0x41f13f
push 0x11e0
push 0x4027fae
push 6
call fcn.0047f8f3
add esp, 0xc
test eax, eax
je 0x41f1ca
cmp dword [ebp + 0x20], 0
je 0x41f15b
mov eax, 2
jmp 0x41f160
mov eax, 0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], esp
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
push 0
mov eax, 0x2f
call fcn.0047f905
cmp dword [ebp - 0x34], esp
je 0x41f19d
push 0x121d
push 0x4027fae
push 6
call fcn.0047f8f3
add esp, 0xc
mov dword [ebp - 0x30], esp
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x30
call fcn.0047f905
cmp dword [ebp - 0x30], esp
je 0x41f1ca
push 0x1258
push 0x4027fae
push 6
call fcn.0047f8f3
add esp, 0xc
cmp dword [ebp - 8], 0
jne 0x41f1e8
cmp dword [0xab1830], 0
je 0x41f1e8
mov eax, 1
jmp 0x41f1ed
mov eax, 0
test eax, eax
je 0x41f229
mov dword [ebp - 0x30], esp
push dword [0xab1830]
push 0xffffffff
mov eax, 0x2d
call fcn.0047f905
cmp dword [ebp - 0x30], esp
je 0x41f229
push 0x1319
push 0x4027fae
push 6
call fcn.0047f8f3
add esp, 0xc
mov dword [0xab182c], 0
push 0xab17fc
call fcn.0041fee8
push 0xab1800
call fcn.0041fee8
push 0xab1804
call fcn.0041fee8
push 0xab1808
call fcn.0041fee8
push 0xab180c
call fcn.0041fee8
cmp dword [ebp + 0x18], 0
je 0x41f2a1
push 0xab1810
call fcn.0041fee8
push 0xab1814
call fcn.0041fee8
push 0xab1818
call fcn.0041fee8
push 0xab181c
call fcn.0041fee8
push 0xab1820
call fcn.0041fee8
mov dword [ebp - 0x30], esp
push dword [0xab17ec]
mov eax, 0x31
call fcn.0047f905
cmp dword [ebp - 0x30], esp
je 0x41f2d0
push 0x1500
push 0x4027fae
push 6
call fcn.0047f8f3
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x41f30b
mov dword [ebp - 0x30], esp
push 0x8000
push 0
push dword [ebp - 0x18]
call sub.KERNEL32.dll_VirtualFree_1
cmp dword [ebp - 0x30], esp
je 0x41f30b
push 0x156c
push 0x4027fae
push 6
call fcn.0047f8f3
add esp, 0xc
mov eax, dword [ebp - 8]
jmp 0x41f313
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41f324
push ebx
call fcn.0047f8ed
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x20