Function at 0x1402440
Capabilities:
Allocate or change rwx memory
Check for software breakpoints
Execute shellcode via indirect call
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa4
push ebx
push esi
mov ebx, edx
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x28], esi
test ebx, ebx
jne 0x140246d
lea eax, [edx + 0x57]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x159e0c0], eax
je 0x1402489
mov eax, 0x10dd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [0x159e0bc]
test eax, eax
jne 0x14029d1
test esi, esi
je 0x14024b3
mov esi, dword [esi]
test esi, esi
jne 0x14024c1
mov eax, dword [esp + 0x28]
mov dword [0x159e0bc], 6
mov dword [0x159e0c8], eax
mov eax, 6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
cmp byte [esi], 0xff
mov dword [esp + 0x34], eax
mov dword [esp + 0x24], eax
jne 0x14024f0
cmp byte [esi + 1], 0x25
jne 0x14024f0
mov eax, dword [esi + 2]
mov ecx, esi
mov edx, eax
mov dword [esp + 0xc], eax
call fcn.01401bd0
test al, al
je 0x14024f0
mov esi, dword [esp + 0xc]
mov esi, dword [esi]
cmp byte [esi], 0xeb
jne 0x1402532
movsx eax, byte [esi + 1]
add esi, 2
add esi, eax
mov al, byte [esi]
cmp al, 0xff
jne 0x1402526
cmp byte [esi + 1], 0x25
jne 0x1402532
mov eax, dword [esi + 2]
mov ecx, esi
mov edx, eax
mov dword [esp + 0xc], eax
call fcn.01401bd0
test al, al
je 0x1402532
mov esi, dword [esp + 0xc]
mov esi, dword [esi]
jmp 0x1402532
cmp al, 0xe9
jne 0x1402532
mov eax, dword [esi + 1]
add esi, 5
add esi, eax
cmp byte [ebx], 0xff
jne 0x140255b
cmp byte [ebx + 1], 0x25
jne 0x140255b
mov eax, dword [ebx + 2]
mov ecx, ebx
mov edx, eax
mov dword [esp + 0xc], eax
call fcn.01401bd0
test al, al
je 0x140255b
mov ebx, dword [esp + 0xc]
mov ebx, dword [ebx]
mov dword [esp + 0x18], ebx
cmp byte [ebx], 0xeb
jne 0x14025a5
movsx eax, byte [ebx + 1]
add ebx, 2
add ebx, eax
mov dword [esp + 0x18], ebx
mov al, byte [ebx]
cmp al, 0xff
jne 0x1402595
cmp byte [ebx + 1], 0x25
jne 0x14025a5
mov eax, dword [ebx + 2]
mov ecx, ebx
mov edx, eax
mov dword [esp + 0xc], eax
call fcn.01401bd0
test al, al
je 0x14025a5
mov ebx, dword [esp + 0xc]
mov ebx, dword [ebx]
jmp 0x14025a1
cmp al, 0xe9
jne 0x14025a5
mov eax, dword [ebx + 1]
add ebx, 5
add ebx, eax
mov dword [esp + 0x18], ebx
cmp ebx, esi
jne 0x14025ba
cmp dword [0x159e030], edi
jne 0x14029c6
jmp 0x1402987
push 0x18
call fcn.0141e475
mov dword [esp + 0x28], eax
lea edx, [esp + 0x10]
lea eax, [esp + 0x20]
mov ecx, esi
push eax
call fcn.01401c90
mov ecx, dword [0x159e0c4]
add esp, 8
mov ebx, dword [esp + 0x1c]
mov edx, dword [esp + 0xc]
mov eax, dword [0x159e0cc]
test ecx, ecx
jne 0x14025fb
test eax, eax
je 0x140260e
mov ecx, eax
mov dword [0x159e0c4], ecx
mov edi, dword [ecx + 8]
test edi, edi
je 0x140260e
cmp edi, edx
jb 0x140260e
cmp edi, ebx
jbe 0x1402697
mov ecx, eax
mov dword [0x159e0c4], ecx
test eax, eax
je 0x140263a
test ecx, ecx
je 0x140262d
mov eax, dword [ecx + 8]
test eax, eax
je 0x140262d
cmp eax, edx
jb 0x140262d
cmp eax, ebx
jbe 0x1402697
mov ecx, dword [ecx + 4]
mov dword [0x159e0c4], ecx
test ecx, ecx
jne 0x140261e
mov ecx, esi
push ebx
and ecx, 0xffff0000
call fcn.01401f20
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x1402982
mov dword [ecx], 0x52727464
xor edx, edx
mov dword [ecx + 8], 0
mov edi, 0x38b
mov eax, dword [0x159e0cc]
mov dword [ecx + 4], eax
lea eax, [ecx + 0xffa8]
mov dword [0x159e0c4], ecx
mov dword [0x159e0cc], ecx
mov dword [eax + 0x40], edx
mov edx, eax
sub eax, 0x48
sub edi, 1
jne 0x1402683
mov dword [ecx + 8], edx
mov edx, dword [esp + 0xc]
mov eax, dword [ecx + 8]
mov dword [esp + 0x14], eax
cmp eax, edx
jb 0x1402982
cmp eax, ebx
ja 0x1402982
mov ebx, eax
xorps xmm0, xmm0
mov dword [esp + 0x34], ebx
mov edx, esi
mov dword [esp + 0x20], ebx
mov eax, dword [ebx + 0x40]
mov dword [ecx + 8], eax
lea eax, [ebx + 0x38]
mov dword [ebx], 0xcccccccc
mov dword [ebx + 4], 0xcccccccc
mov dword [ebx + 8], 0xcccccccc
mov dword [ebx + 0xc], 0xcccccccc
mov dword [ebx + 0x10], 0xcccccccc
mov dword [ebx + 0x14], 0xcccccccc
mov dword [ebx + 0x18], 0xcccccccc
mov dword [ebx + 0x1c], 0xcccccccc
mov dword [ebx + 0x20], 0xcccccccc
mov dword [ebx + 0x24], 0xcccccccc
mov dword [ebx + 0x28], 0xcccccccc
mov dword [ebx + 0x2c], 0xcccccccc
mov dword [ebx + 0x30], 0xcccccccc
mov dword [ebx + 0x34], 0xcccccccc
mov dword [ebx + 0x40], 0xcccccccc
mov dword [ebx + 0x44], 0xcccccccc
add ebx, 0x1e
mov dword [esp + 0x1c], eax
movq qword [eax], xmm0
mov dword [esp + 0x3c], ebx
mov dword [esp + 0xc], 0
nop dword [eax]
mov ebx, dword [esp + 0x20]
lea eax, [esp + 0x6c]
test ebx, ebx
mov dword [esp + 0x60], eax
lea ecx, [esp + 0x70]
mov dword [esp + 0x50], 0
xorps xmm0, xmm0
mov dword [esp + 0x54], 0
lea eax, [esp + 0x2c]
mov dword [esp + 0x58], 0
cmovne ecx, ebx
mov dword [esp + 0x64], eax
mov dword [esp + 0x6c], 0
mov edi, edx
mov dword [esp + 0x2c], 0
movups xmmword [esp + 0x40], xmm0
test edx, edx
jne 0x14027af
push 0xd
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor edx, edx
jmp 0x14027c7
movzx eax, byte [edx]
push edx
push ecx
lea ecx, [esp + 0x48]
lea eax, [eax*8 + 0x15a0818]
push eax
mov eax, dword [eax + 4]
call eax
mov edx, eax
mov eax, edx
sub eax, edi
add eax, dword [esp + 0x2c]
add ebx, eax
mov dword [esp + 0x20], ebx
mov ebx, edx
mov ah, byte [esp + 0x20]
sub ebx, esi
sub ah, byte [esp + 0x14]
mov al, bl
mov dword [esp + 0x38], ebx
mov cl, ah
mov ebx, dword [esp + 0x1c]
and al, 7
inc dword [esp + 0x1c]
shl cl, 3
or cl, al
mov byte [esp + 0x13], ah
mov byte [ebx], cl
mov ecx, dword [esp + 0xc]
mov ebx, dword [esp + 0x38]
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 8
jae 0x140286d
mov al, byte [edi]
cmp al, 0xeb
je 0x140286d
cmp al, 0xe9
je 0x140286d
cmp al, 0xe0
je 0x140286d
cmp al, 0xc2
je 0x140286d
cmp al, 0xc3
je 0x140286d
cmp al, 0xcc
je 0x140286d
cmp al, 0xf3
jne 0x1402863
cmp byte [edi + 1], 0xc3
je 0x140286d
cmp al, 0x26
je 0x140284c
cmp al, 0x2e
je 0x140284c
cmp al, 0x36
je 0x140284c
cmp al, 0x3e
je 0x140284c
cmp al, 0x64
je 0x140284c
cmp al, 0x65
jne 0x1402858
cmp byte [edi + 1], 0xff
jne 0x1402858
cmp byte [edi + 2], 0x25
je 0x140286d
cmp ebx, 5
jb 0x1402750
jmp 0x140289d
cmp al, 0xff
jne 0x1402834
cmp byte [edi + 1], 0x25
jmp 0x1402856
cmp ebx, 5
jae 0x1402894
mov ecx, edx
call fcn.01401d20
test eax, eax
je 0x1402972
add edx, eax
mov ebx, edx
sub ebx, esi
cmp ebx, 5
jb 0x1402872
mov ah, byte [esp + 0x13]
mov ecx, dword [esp + 0xc]
cmp ecx, 8
ja 0x1402972
mov edi, dword [esp + 0x3c]
cmp dword [esp + 0x20], edi
jbe 0x14028a8
int3
mov byte [edi], ah
mov eax, dword [esp + 0x14]
push ebx
push esi
mov byte [eax + 0x36], bl
add eax, 0x20
push eax
call fcn.01420aa0
add esp, 0xc
cmp ebx, 0x19
jbe 0x14028ce
mov edi, 6
jmp 0x1402987
mov ecx, dword [esp + 0x14]
lea edx, [esi + ebx]
mov eax, dword [esp + 0x18]
mov dword [ecx + 0x44], eax
mov dword [ecx + 0x40], edx
movzx ecx, byte [edi]
add ecx, dword [esp + 0x14]
lea eax, [ecx + 5]
mov byte [ecx], 0xe9
sub edx, eax
mov eax, edi
mov dword [ecx + 1], edx
add ecx, 5
sub eax, ecx
xor edx, edx
cmp ecx, edi
cmova eax, edx
test eax, eax
je 0x1402912
push eax
push 0xcc
push ecx
call fcn.01420890
add esp, 0xc
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0
push eax
push 0x40
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1402937
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x1402987
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x14]
mov dword [ecx + 0x10], eax
mov dword [ecx + 4], 0
mov dword [ecx + 0xc], esi
mov eax, dword [esp + 0x30]
mov dword [ecx + 0x14], eax
mov eax, dword [0x159e0d4]
mov dword [ecx], eax
xor eax, eax
mov dword [0x159e0d4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [0x159e030], 0
mov edi, 9
jne 0x140298d
jmp 0x1402987
mov edi, 8
mov dword [0x159e0bc], edi
mov ebx, dword [esp + 0x34]
test ebx, ebx
je 0x14029b3
push 0x48
push 0
mov esi, ebx
push ebx
and esi, 0xffff0000
call fcn.01420890
mov eax, dword [esi + 8]
add esp, 0xc
mov dword [ebx + 0x40], eax
mov dword [esi + 8], ebx
mov eax, dword [esp + 0x24]
test eax, eax
je 0x14029c6
push 0x18
push eax
call fcn.0141e43b
add esp, 8
mov eax, dword [esp + 0x28]
mov dword [0x159e0c8], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc