Function at 0x4d3ba0
Capabilities:
Allocate or change rwx memory
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov eax, dword [0x5f3418]
xor eax, ebp
mov dword [esp + 0x68], eax
test ecx, ecx
je 0x4d3bc7
mov dword [ecx], 0
mov ebx, dword [ebp + 0x18]
test edx, edx
je 0x4d3bd4
mov dword [edx], 0
test ebx, ebx
je 0x4d3bde
mov dword [ebx], 0
mov esi, dword [0x6c04dc]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, 0x10dd
cmp esi, eax
jne 0x4d407b
mov edi, dword [0x6c04e8]
test edi, edi
jne 0x4d407b
mov eax, dword [ebp + 8]
mov edi, 6
test eax, eax
je 0x4d407b
mov esi, dword [eax]
test esi, esi
je 0x4d3c4c
mov ecx, dword [ebp + 0xc]
movzx eax, byte [esi]
cmp eax, 0xeb
je 0x4d3c5b
cmp eax, 0xff
jne 0x4d3c6c
cmp byte [esi + 1], 0x25
jne 0x4d3c6c
mov edi, dword [esi + 2]
mov ecx, esi
mov edx, edi
call fcn.00580710
mov ecx, dword [ebp + 0xc]
test al, al
je 0x4d3c6c
mov esi, dword [edi]
jmp 0x4d3c6c
mov dword [0x6c04e8], 6
jmp 0x4d4076
movsx eax, byte [esi + 1]
add esi, eax
add esi, 2
cmp byte [esi], 0xe9
jne 0x4d3c6c
add esi, dword [esi + 1]
test ecx, ecx
je 0x4d3ca9
movzx eax, byte [ecx]
cmp eax, 0xeb
mov edx, dword [ebp + 0x14]
je 0x4d3cb0
cmp eax, 0xff
jne 0x4d3cc1
cmp byte [ecx + 1], 0x25
jne 0x4d3cc1
mov edx, dword [ecx + 2]
mov edi, ecx
mov dword [esp + 0xc], edx
call fcn.00580710
mov ecx, edi
mov edx, dword [ebp + 0x14]
test al, al
je 0x4d3cc1
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
jmp 0x4d3cc1
xor ecx, ecx
mov edx, dword [ebp + 0x14]
jmp 0x4d3cc1
movsx eax, byte [ecx + 1]
add ecx, eax
add ecx, 2
cmp byte [ecx], 0xe9
jne 0x4d3cc1
add ecx, dword [ecx + 1]
cmp ecx, esi
je 0x4d3d39
test edx, edx
je 0x4d3ccb
mov dword [edx], esi
test ebx, ebx
je 0x4d3cd1
mov dword [ebx], ecx
mov dword [esp + 0x1c], ecx
push 0x18
call fcn.00510d64
add esp, 4
mov edx, eax
xor eax, eax
mov edi, 8
test edx, edx
je 0x4d3d57
lea eax, [esi - 0x7ff80000]
cmp esi, 0x7ff80001
mov ebx, 0x10000
cmovae ebx, eax
lea eax, [esi + 0x7ff80000]
mov dword [esp + 0x14], esi
test esi, esi
mov ecx, 0xfff80000
cmovns ecx, eax
mov dword [esp + 0xc], ecx
mov eax, dword [0x6c04f4]
mov ecx, dword [0x6c04f0]
test eax, eax
mov dword [esp + 0x10], edx
jne 0x4d3d5e
test ecx, ecx
je 0x4d3d5e
mov dword [0x6c04f4], ecx
mov eax, ecx
jmp 0x4d3d62
xor edi, edi
cmp dword [0x6c04d8], 0
mov eax, 0
mov edx, 0
jne 0x4d4073
jmp 0x4d403d
xor edx, edx
jmp 0x4d403d
test eax, eax
je 0x4d3d77
mov esi, dword [eax + 8]
test esi, esi
je 0x4d3d77
cmp esi, ebx
jb 0x4d3d77
cmp esi, dword [esp + 0xc]
jbe 0x4d3e88
test ecx, ecx
je 0x4d3d99
mov eax, ecx
mov esi, dword [eax + 8]
test esi, esi
je 0x4d3d92
cmp esi, ebx
jb 0x4d3d92
cmp esi, dword [esp + 0xc]
jbe 0x4d3e24
mov eax, dword [eax + 4]
test eax, eax
jne 0x4d3d7d
mov dword [0x6c04f4], 0
mov eax, ebx
mov ebx, dword [esp + 0x14]
and ebx, 0xffff0000
mov dword [esp + 0x18], eax
cmp ebx, eax
jbe 0x4d402d
mov eax, ebx
cmp eax, 0x80000001
mov esi, eax
mov ecx, 0x6fff0000
cmovb esi, ecx
cmp eax, 0x70000000
cmovb esi, eax
pcmpeqd xmm0, xmm0
movdqu xmmword [esp + 0x4c], xmm0
movdqa xmmword [esp + 0x40], xmm0
push 0x1c
lea eax, [esp + 0x44]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4d402d
cmp dword [esp + 0x50], 0x10000
jne 0x4d3e0e
cmp dword [esp + 0x4c], 0x10000
jae 0x4d3e2b
mov eax, dword [esp + 0x44]
mov ecx, 0xffff0000
add eax, ecx
cmp eax, dword [esp + 0x18]
ja 0x4d3dbd
jmp 0x4d402d
mov dword [0x6c04f4], eax
jmp 0x4d3e88
push 0x40
push 0x3000
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x6c04f4], eax
test eax, eax
je 0x4d402d
mov dword [eax], 0x52727464
mov dword [eax + 8], 0
mov ecx, dword [0x6c04f0]
mov dword [eax + 4], ecx
mov dword [0x6c04f0], eax
lea esi, [eax + 0x10000]
xor edx, edx
mov ecx, 0x7ff
mov dword [esi - 8], edx
add esi, 0xffffffe0
dec ecx
mov edx, esi
cmp ecx, 2
ja 0x4d3e73
mov dword [eax + 8], esi
mov ebx, dword [esp + 0x18]
cmp esi, ebx
jb 0x4d4037
cmp esi, dword [esp + 0xc]
ja 0x4d4037
mov ecx, dword [esi + 0x18]
mov dword [eax + 8], ecx
movdqa xmm0, xmmword [0x5e2490]
movdqu xmmword [esi + 0x10], xmm0
movdqu xmmword [esi], xmm0
test esi, esi
je 0x4d4037
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4d3ec2
mov dword [eax], esi
xor edx, edx
mov edi, dword [esp + 0x14]
xor ebx, ebx
mov dword [esp + 0x40], ebx
add edx, esi
lea eax, [esp + 0x40]
push eax
push ebx
push edi
push edx
call fcn.0058ac40
cmp dword [esp + 0x40], ebx
jne 0x4d3f79
mov edx, eax
sub edx, dword [esp + 0x14]
movzx ecx, byte [edi]
cmp ecx, 0x63
jle 0x4d3f20
cmp ecx, 0xe2
jg 0x4d3f34
mov ebx, edx
lea edx, [ecx - 0x64]
cmp edx, 2
mov edx, ebx
jb 0x4d3f4c
add ecx, 0xffffff3e
cmp ecx, 0x1e
ja 0x4d3f58
mov edi, 0x40000403
bt edi, ecx
jb 0x4d3f70
jmp 0x4d3f58
add ecx, 0xffffffda
cmp ecx, 0x10
ja 0x4d3f58
mov ebx, 0x10101
bt ebx, ecx
jb 0x4d3f4c
jmp 0x4d3f58
cmp ecx, 0xe3
je 0x4d3f4c
cmp ecx, 0xff
jne 0x4d3f68
cmp byte [edi + 1], 0x25
jne 0x4d3f58
jmp 0x4d3f70
cmp byte [edi + 1], 0xff
jne 0x4d3f58
cmp byte [edi + 2], 0x25
je 0x4d3f70
mov edi, eax
cmp edx, 5
jl 0x4d3ec8
jmp 0x4d4092
cmp ecx, 0xe9
jne 0x4d3f58
cmp edx, 4
jg 0x4d4092
mov edi, 9
cmp dword [0x6c04d8], 0
mov eax, esi
mov edx, dword [esp + 0x10]
jne 0x4d4045
jmp 0x4d403d
cmp ebx, 0x80000001
mov esi, ebx
mov eax, 0x80010000
cmovb esi, eax
cmp ebx, 0x70000000
cmovb esi, ebx
pcmpeqd xmm0, xmm0
movdqu xmmword [esp + 0x2c], xmm0
movdqa xmmword [esp + 0x20], xmm0
push 0x1c
lea eax, [esp + 0x24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4d4037
mov ebx, dword [esp + 0x2c]
cmp dword [esp + 0x30], 0x10000
jne 0x4d4029
cmp ebx, 0x10000
jb 0x4d4029
mov eax, esi
and eax, 0xffff
je 0x4d4005
mov esi, 0x10000
sub esi, eax
sub ebx, esi
mov dword [esp + 0x2c], ebx
add esi, dword [esp + 0x20]
mov dword [esp + 0x20], esi
push 0x40
push 0x3000
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x6c04f4], eax
test eax, eax
jne 0x4d3e4b
mov ebx, dword [esp + 0x2c]
add ebx, dword [esp + 0x20]
cmp ebx, dword [esp + 0xc]
jb 0x4d3f96
mov edx, dword [esp + 0x10]
xor eax, eax
mov dword [0x6c04e8], edi
mov esi, eax
test esi, esi
je 0x4d4066
mov eax, esi
and eax, 0xffff0000
pxor xmm0, xmm0
movdqu xmmword [esi + 0x10], xmm0
movdqu xmmword [esi], xmm0
mov ecx, dword [eax + 8]
mov dword [esi + 0x18], ecx
mov dword [eax + 8], esi
test edx, edx
je 0x4d4073
push edx
call fcn.0050fc7c
add esp, 4
mov eax, dword [ebp + 8]
mov dword [0x6c04ec], eax
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.00512ee3
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
mov edi, 6
cmp edx, 0x12
ja 0x4d413b
mov eax, dword [esp + 0x14]
lea ecx, [eax + edx]
mov dword [esi + 0x18], ecx
mov eax, dword [esp + 0x1c]
mov dword [esi + 0x1c], eax
mov byte [esi + 0x17], dl
lea eax, [esi + edx]
add eax, 5
mov byte [eax - 5], 0xe9
sub ecx, eax
mov dword [eax - 4], ecx
cmp edx, 0x12
je 0x4d40e2
mov ecx, 0x12
sub ecx, edx
push ecx
push 0xcc
push eax
mov edi, edx
call fcn.005191b0
mov edx, edi
add esp, 0xc
mov dword [esp + 0x40], 0
lea eax, [esp + 0x40]
push eax
push 0x40
push edx
mov edi, dword [esp + 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x4d4133
mov ecx, dword [esp + 0x10]
mov dword [ecx + 4], 0
mov eax, dword [ebp + 8]
mov dword [ecx + 8], eax
mov dword [ecx + 0x10], esi
mov dword [ecx + 0xc], edi
mov eax, dword [esp + 0x40]
mov dword [ecx + 0x14], eax
mov eax, dword [0x6c04e0]
mov dword [ecx], eax
mov dword [0x6c04e0], ecx
xor edi, edi
jmp 0x4d407b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, esi
mov edx, dword [esp + 0x10]
jmp 0x4d403d