Function at 0x40de10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x40
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x11]
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
add eax, dword [ecx + 0x15]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 5]
mov dword [esp + 4], eax
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub esp, 0x10
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x38], 0xfd361f24
mov edi, dword [sym.imp.ADVAPI32.dll_BuildSecurityDescriptorA]
jmp 0x40de90
mov dword [ebp - 0x38], 0x29d2b8e8
mov eax, dword [ebp - 0x38]
cmp eax, 0x9294bbab
jg 0x40deb0
cmp eax, 0x89e1e28f
jne 0x40de90
jmp 0x40de89
cmp eax, 0x9582f6b4
jg 0x40df00
cmp eax, 0x9294bbac
jne 0x40de90
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 5]
mov edx, dword [ebp - 0x2c]
add edx, dword [eax + 1]
add eax, 0xd
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00403520
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 5]
lea eax, [eax + ecx + 0xd]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x38], 0x7a3ba368
jmp 0x40de90
cmp eax, 0x97bb76f6
jg 0x40df1a
cmp eax, 0x9582f6b5
jne 0x40de90
mov dword [ebp - 0x38], 0x89e1e28f
jmp 0x40de90
cmp eax, 0xa4a59486
jg 0x40df5d
cmp eax, 0x97bb76f7
jne 0x40de90
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
add eax, dword [ecx + 0x11]
mov ecx, dword [ecx + 0xd]
mov edx, dword [ebp - 0x2c]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call fcn.0040d7f0
test eax, eax
sets byte [ebp - 9]
mov dword [ebp - 0x38], 0x17afa78b
jmp 0x40de90
cmp eax, 0xaa689e4f
jg 0x40df92
cmp eax, 0xa4a59487
jne 0x40de90
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx + 1]
add ecx, eax
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.0040cc80
mov dword [ebp - 0x38], 0xa148d25
jmp 0x40de90
cmp eax, 0xb8e102e9
jg 0x40dff1
cmp eax, 0xaa689e50
jne 0x40de90
mov eax, dword [ebp - 0x28]
inc eax
mov ecx, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 8], 0x20
call fcn.00403520
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfe
and eax, 1
add eax, edx
not eax
or eax, ecx
cmp eax, 0xffffffff
mov eax, 0xa4a59487
jne 0x40dfe9
mov eax, 0xa148d25
mov dword [ebp - 0x38], eax
jmp 0x40de90
cmp eax, 0xbc2e65d4
jg 0x40e015
cmp eax, 0xb8e102ea
jne 0x40de90
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x38], 0xc8191e7c
jmp 0x40de90
cmp eax, 0xbed8347a
jg 0x40e033
cmp eax, 0xbc2e65d5
jne 0x40de90
mov dword [ebp - 0x38], 0x7882062f
jmp 0x40de90
cmp eax, 0xc8191e7b
jg 0x40e051
cmp eax, 0xbed8347b
jne 0x40de90
mov dword [ebp - 0x38], 0x89e1e28f
jmp 0x40de90
cmp eax, 0xd9bb6491
jg 0x40e068
cmp eax, 0xc8191e7c
jne 0x40de90
jmp 0x40e324
cmp eax, 0xebdc540d
jg 0x40e088
cmp eax, 0xd9bb6492
jne 0x40de90
mov esi, dword [edi]
mov dword [ebp - 0x38], 0xbc2e65d5
jmp 0x40de90
cmp eax, 0xfd361f23
jg 0x40e0d9
cmp eax, 0xebdc540e
jne 0x40de90
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov edx, 0x7e07ef89
sub edx, dword [ecx + 1]
lea eax, [edx + eax - 0x7e07ef89]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
mov edx, dword [edx + 0x19]
add edx, ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.0040d1e0
mov dword [ebp - 0x38], 0xc08a179
jmp 0x40de90
cmp eax, 0x183c4c3
jg 0x40e103
cmp eax, 0xfd361f24
jne 0x40de90
mov eax, 0x32c3cd54
cmp dword [ebp - 0x10], 0
jne 0x40e0fb
mov eax, 0x3fe3a321
mov dword [ebp - 0x38], eax
jmp 0x40de90
cmp eax, 0x76739cf
jg 0x40e123
cmp eax, 0x183c4c4
jne 0x40de90
mov esi, dword [edi]
mov dword [ebp - 0x38], 0xd9bb6492
jmp 0x40de90
cmp eax, 0xa148d24
jg 0x40e160
cmp eax, 0x76739d0
jne 0x40de90
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_VirtualFree]
sub esp, 0xc
mov dword [ebp - 0x38], 0x7a6e1918
jmp 0x40de90
cmp eax, 0x7c996bb2
jg 0x40e1c2
cmp eax, 0xc08a178
jg 0x40e1f8
cmp eax, 0xa148d25
jne 0x40de90
call fcn.0040e9a0
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
mov ecx, eax
not ecx
and ecx, 0xfb9d6273
and eax, 0x8c
add eax, ecx
mov ecx, eax
xor ecx, 0x4629d8c
and ecx, 0xfffffffc
xor eax, 0xfb9d6270
or eax, ecx
cmp eax, 0xffffffff
mov eax, 0xebdc540e
jne 0x40e1ba
mov eax, 0xc08a179
mov dword [ebp - 0x38], eax
jmp 0x40de90
cmp eax, 0x7c996bb3
jne 0x40de90
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
add eax, dword [ecx + 0x11]
mov ecx, dword [ecx + 0xd]
mov edx, dword [ebp - 0x2c]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call fcn.0040d7f0
mov dword [ebp - 0x38], 0x97bb76f7
jmp 0x40de90
cmp eax, 0x17afa78a
jg 0x40e216
cmp eax, 0xc08a179
jne 0x40de90
mov dword [ebp - 0x38], 0x97bb76f7
jmp 0x40de90
cmp eax, 0x21f02917
jg 0x40e241
cmp eax, 0x17afa78b
jne 0x40de90
mov al, byte [ebp - 9]
test al, al
mov eax, 0xbed8347b
jne 0x40e239
mov eax, 0xb8e102ea
mov dword [ebp - 0x38], eax
jmp 0x40de90
cmp eax, 0x29d2b8e7
jg 0x40e270
cmp eax, 0x21f02918
jne 0x40de90
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x20]
mov eax, 0x9294bbac
cmp ecx, dword [edx + 0xd]
jb 0x40e268
mov eax, 0xaa689e50
mov dword [ebp - 0x38], eax
jmp 0x40de90
cmp eax, 0x32c3cd53
jg 0x40e28e
cmp eax, 0x29d2b8e8
jne 0x40de90
mov dword [ebp - 0x38], 0x7882062f
jmp 0x40de90
cmp eax, 0x3fe3a320
jg 0x40e2b3
cmp eax, 0x32c3cd54
jne 0x40de90
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x38], 0x21f02918
jmp 0x40de90
cmp eax, 0x7882062e
jg 0x40e2d1
cmp eax, 0x3fe3a321
jne 0x40de90
mov dword [ebp - 0x38], 0xd9bb6492
jmp 0x40de90
cmp eax, 0x7882062f
je 0x40e2ee
cmp eax, 0x7a3ba368
jne 0x40e306
inc dword [ebp - 0x30]
mov dword [ebp - 0x38], 0x21f02918
jmp 0x40de90
mov eax, 0x76739d0
cmp dword [ebp - 0x2c], 0
jne 0x40e2fe
mov eax, 0x7a6e1918
mov dword [ebp - 0x38], eax
jmp 0x40de90
cmp eax, 0x7a6e1918
jne 0x40de90
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x38], 0xc8191e7c
jmp 0x40de90
mov eax, dword [ebp - 0x14]
add esp, 0x40
pop esi
pop edi
pop ebp
ret