Function at 0x408fe0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x3c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x18]
add ecx, dword [eax + 0x11]
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
add eax, dword [ecx + 0x15]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 5]
mov dword [esp + 4], eax
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub esp, 0x10
mov dword [ebp - 0x28], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x34], 0x3c8da520
mov edi, dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
jmp 0x409070
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x34], 0x7ab59492
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x34]
cmp eax, 0x8cdcde81
jg 0x409090
cmp eax, 0x803cd38e
jne 0x409070
jmp 0x409059
cmp eax, 0x9819c433
jg 0x4090c0
cmp eax, 0x8cdcde82
jne 0x409070
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
mov eax, 0xe5a4e414
cmp ecx, dword [edx + 0xd]
jb 0x4090b3
mov eax, 0x33b0d279
mov dword [ebp - 0x34], eax
jmp 0x409070
cmp eax, 0x7ab59491
jg 0x4090ec
cmp eax, 0x71058a46
jg 0x4090fc
cmp eax, 0x3c8da51f
jg 0x409132
cmp eax, 0x9981d8a1
jg 0x409155
cmp eax, 0x9819c434
jne 0x409070
mov dword [ebp - 0x34], 0x103b6fa4
jmp 0x409070
cmp eax, 0x7ab59492
jne 0x409070
jmp 0x4093c1
cmp eax, 0x71058a47
jne 0x409070
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_VirtualFree]
sub esp, 0xc
mov dword [ebp - 0x34], 0x803cd38e
jmp 0x409070
cmp eax, 0x3c8da520
jne 0x409070
mov eax, 0xd99a144c
cmp dword [ebp - 0xc], 0
jne 0x40914d
mov eax, 0xe32f4225
mov dword [ebp - 0x34], eax
jmp 0x409070
cmp eax, 0xbb681d65
jg 0x4091bc
cmp eax, 0x9981d8a2
jne 0x409070
call fcn.0040b610
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
mov ecx, eax
not ecx
and ecx, 0x9b0b4801
and eax, 0xfe
add eax, ecx
mov ecx, eax
xor ecx, 0x64f4b7fe
and eax, 0x9a
mov edx, ecx
and edx, 0x89024865
add edx, eax
xor edx, 0x89024866
and ecx, 0xfffffffc
or ecx, edx
cmp ecx, 0xffffffff
mov eax, 0x307d1eb2
jne 0x4091b4
mov eax, 0xbb681d66
mov dword [ebp - 0x34], eax
jmp 0x409070
cmp eax, 0xca3196a6
jg 0x409203
cmp eax, 0xbb681d66
jne 0x409070
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
add eax, dword [ecx + 0x11]
mov ecx, dword [ecx + 0xd]
mov edx, dword [ebp - 0x28]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call fcn.00408a80
test eax, eax
mov eax, 0x9819c434
js 0x4091fb
mov eax, 0xca3196a7
mov dword [ebp - 0x34], eax
jmp 0x409070
cmp eax, 0xd99a144b
jg 0x409227
cmp eax, 0xca3196a7
jne 0x409070
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x34], 0x7ab59492
jmp 0x409070
cmp eax, 0xe32f4224
jg 0x40924c
cmp eax, 0xd99a144c
jne 0x409070
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x34], 0x8cdcde82
jmp 0x409070
cmp eax, 0xe5a4e413
jg 0x40926c
cmp eax, 0xe32f4225
jne 0x409070
mov esi, dword [edi]
mov dword [ebp - 0x34], 0x103b6fa4
jmp 0x409070
cmp eax, 0x103b6fa3
jg 0x4092b6
cmp eax, 0xe5a4e414
jne 0x409070
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 5]
mov edx, dword [ebp - 0x28]
add edx, dword [eax + 1]
add eax, 0xd
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00402640
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 5]
lea eax, [eax + ecx + 0xd]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], 0x343871c0
jmp 0x409070
cmp eax, 0x13864ea4
jg 0x4092e0
cmp eax, 0x103b6fa4
jne 0x409070
mov eax, 0x71058a47
cmp dword [ebp - 0x28], 0
jne 0x4092d8
mov eax, 0x803cd38e
mov dword [ebp - 0x34], eax
jmp 0x409070
cmp eax, 0x307d1eb1
jg 0x409315
cmp eax, 0x13864ea5
jne 0x409070
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx + 1]
add ecx, eax
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.00408310
mov dword [ebp - 0x34], 0x9981d8a2
jmp 0x409070
cmp eax, 0x307d1eb2
je 0x409374
cmp eax, 0x33b0d279
jne 0x4093a7
mov eax, dword [ebp - 0x24]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 8], 0x20
call fcn.00402640
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
mov ecx, eax
not ecx
mov edx, ecx
and edx, 6
and eax, 0xf9
add eax, edx
xor eax, 7
or eax, ecx
cmp eax, 0xffffffff
mov eax, 0x13864ea5
jne 0x40936c
mov eax, 0x9981d8a2
mov dword [ebp - 0x34], eax
jmp 0x409070
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
sub eax, dword [ecx + 1]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov edx, dword [edx + 0x19]
add edx, ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.00408690
mov dword [ebp - 0x34], 0xbb681d66
jmp 0x409070
cmp eax, 0x343871c0
jne 0x409070
inc dword [ebp - 0x2c]
mov dword [ebp - 0x34], 0x8cdcde82
jmp 0x409070
mov eax, dword [ebp - 0x10]
add esp, 0x3c
pop esi
pop edi
pop ebp
ret