Function at 0x61ee80
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push edi
push esi
sub esp, 0x14
cmp dword [esp + 0x24], 0x2d
jne 0x61eebe
mov dword [esp], str.KERNEL32.DLL
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov edi, eax
test edi, edi
jne 0x61eeda
mov eax, edi
and eax, 1
xor eax, edi
not eax
test eax, eax
je 0x61eeda
mov eax, 0x215cb4ca
xor eax, 0x215cb4cb
jmp 0x61f031
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esp + 4], eax
mov dword [esp], ecx
call sub.KERNEL32.dll_GetProcAddress
add esp, 0xc
jmp 0x61f14e
mov ebx, 3
mov dword [esp], edi
mov dword [esp + 4], str.SetProcessDEPPolicy
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov esi, eax
test esi, esi
je 0x61ef56
mov eax, esi
and eax, 1
inc eax
xor eax, esi
je 0x61ef56
mov al, 7
movzx eax, al
cmp eax, 0x2e
je 0x61ef99
mov ebx, 0xc
cmp eax, 0x30
je 0x61ef56
cmp eax, 0x48
jne 0x61efb7
mov dword [esp], edi
mov dword [esp + 4], str.GetProcessDEPPolicy
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov edi, eax
test edi, edi
je 0x61f166
mov eax, edi
imul eax, eax
and eax, 3
cmp eax, 2
jne 0x61efde
jmp 0x61f166
cmp ebx, 3
jne 0x61ef6c
mov eax, ebx
and eax, 1
xor eax, ebx
not eax
test eax, eax
jne 0x61f170
mov bl, 0x2f
mov dword [esp], edi
mov dword [esp + 4], str.GetProcessDEPPolicy
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov edi, eax
test edi, edi
jne 0x61efe0
mov eax, edi
imul eax, eax
and eax, 3
cmp eax, 2
jae 0x61efe0
jmp 0x61f166
mov dword [esp], edi
mov dword [esp + 4], str.GetProcessDEPPolicy
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov edi, eax
test edi, edi
jne 0x61efde
jmp 0x61f166
mov dword [esp], edi
mov dword [esp + 4], str.GetProcessDEPPolicy
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov edi, eax
test edi, edi
je 0x61f166
mov al, 1
test al, al
je 0x61f166
mov bl, 0x2f
movzx eax, bl
cmp eax, 0x1f
jne 0x61f02c
mov ebx, 9
mov dword [esp], 1
call esi
sub esp, 4
call sub.KERNEL32.dll_GetCurrentProcess
lea ecx, [esp + 0xc]
mov dword [esp + 8], ecx
lea ecx, [esp + 0x10]
mov dword [esp + 4], ecx
mov dword [esp], eax
call edi
sub esp, 0xc
mov ecx, eax
and ecx, 1
inc ecx
xor ecx, eax
sete cl
movzx ecx, cl
cmp eax, ecx
mov cl, 0x12
jne 0x61f08a
jmp 0x61f097
mov eax, 8
mov ecx, 3
sub ecx, eax
xor ecx, eax
setne cl
movzx ecx, cl
cmp eax, ecx
je 0x61f15c
mov dword [esp], 1
call esi
sub esp, 4
call sub.KERNEL32.dll_GetCurrentProcess
lea ecx, [esp + 0xc]
mov dword [esp + 8], ecx
lea ecx, [esp + 0x10]
mov dword [esp + 4], ecx
mov dword [esp], eax
call edi
sub esp, 0xc
test eax, eax
je 0x61f152
mov cl, 0x12
imul eax, eax
and eax, 3
cmp eax, 3
je 0x61f152
mov ebx, 3
movzx eax, cl
cmp eax, 0x48
jne 0x61f0d9
cmp ebx, 3
jne 0x61f152
mov eax, ebx
or eax, 2
xor ebx, 2
add ebx, eax
je 0x61f152
mov eax, dword [esp + 0x10]
mov ecx, 3
sub ecx, eax
xor ecx, eax
setne cl
movzx ecx, cl
and ecx, eax
mov eax, ecx
imul eax, eax
cmp eax, 3
sete al
movzx eax, al
cmp ecx, eax
jne 0x61f0f5
jmp 0x61f12b
mov eax, 0x1a
mov ecx, dword [esp + 0x10]
mov edx, ecx
not edx
and edx, 1
add edx, ecx
setne dl
movzx edx, dl
test ecx, edx
je 0x61f11c
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x61f149
imul eax, eax
and eax, 3
cmp eax, 2
jae 0x61f149
mov al, 0x7e
movzx ecx, al
cmp ecx, 0x20
je 0x61f135
mov eax, 0x10
cmp ecx, 0x52
je 0x61f135
cmp eax, 0x10
je 0x61f135
mov ecx, eax
and ecx, 1
inc ecx
xor ecx, eax
je 0x61f135
mov dword [esp + 4], str.DEP_policy_is_not_enabled_due_system_configuration_n
jmp 0x61f13d
mov dword [esp + 4], str.DEP_policy_is_not_permanent_due_system_configuration_n
mov dword [esp], 2
call fcn.0061b0f0
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
ret
mov dword [esp + 4], str.Failed_to_get_DEP_policy_n
jmp 0x61f178
mov dword [esp + 4], str.Failed_to_get_DEP_policy_module_n
jmp 0x61f178
mov dword [esp + 4], str.Failed_to_get_GetProcessDEPPolicy_address_n
jmp 0x61f178
mov dword [esp + 4], str.Failed_to_get_SetProcessDEPPolicy_address_n
mov dword [esp], 1
call fcn.0061b0f0
call fcn.0044c0d0
int3