Function at 0x1000ea40
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x30
push ebp
mov ebp, dword [esp + 0x38]
cmp dword [ebp + 0x20c], 0
jne 0x1000ea64
lea eax, [ebp + 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp + 0x20c], eax
mov eax, dword [ebp + 0x20c]
test eax, eax
je 0x1000ea8d
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp + 0x214], eax
test eax, eax
jne 0x1000ea96
mov ecx, dword [ebp + 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
pop ebp
add esp, 0x30
ret 4
lea edx, [esp + 0x38]
push edx
push 0x40
push 0x19
push eax
mov dword [esp + 0x48], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1000eac8
mov eax, dword [ebp + 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
pop ebp
add esp, 0x30
ret 4
push esi
mov esi, dword [ebp + 0x214]
push edi
lea edx, [ebp + 0x21c]
mov ecx, 6
mov edi, edx
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov al, byte [edx]
cmp al, byte [str.XP_ah]
jne 0x1000eaff
mov cl, byte [ebp + 0x21d]
cmp cl, byte [0x10043ea6]
jne 0x1000eaff
mov ecx, 1
jmp 0x1000eb01
xor ecx, ecx
cmp al, byte [0x10043ea0]
je 0x1000eb15
cmp al, byte [0x10043ea1]
je 0x1000eb15
xor eax, eax
jmp 0x1000eb1a
mov eax, 1
test ecx, ecx
jne 0x1000ec9e
test eax, eax
jne 0x1000ec9e
push 0x30
mov esi, edx
push eax
lea edx, [esp + 0x14]
push edx
call fcn.10021df0
lea eax, [esp + 0x18]
push eax
push esi
call fcn.10011920
add esp, 0x14
test eax, eax
je 0x1000eb77
jmp 0x1000eb50
mov eax, dword [esp + 0xc]
add dword [ebp + 0x208], eax
cmp dword [ebp + 0x208], 5
jae 0x1000eb77
lea ecx, [esp + 0xc]
add esi, eax
push ecx
push esi
call fcn.10011920
add esp, 8
test eax, eax
jne 0x1000eb50
cmp dword [ebp + 0x208], 0
jne 0x1000eb98
mov edx, dword [ebp + 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x30
ret 4
push ebx
push 0x40
push 0x1000
push 0x40
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov bl, byte [0x10043ea0]
movzx edx, byte [str.XP_ah]
mov dword [ebp + 0x218], eax
mov eax, dword [ebp + 0x214]
mov byte [eax], bl
mov ecx, dword [ebp + 0x218]
inc eax
sub ecx, eax
sub ecx, 4
mov dword [eax], ecx
mov esi, dword [ebp + 0x218]
movzx eax, byte [0x10043ea6]
mov byte [esi], dl
movzx edx, byte [0x10043ea3]
mov byte [esi + 1], al
mov ecx, dword [ebp + 0x218]
inc esi
inc esi
add ecx, 0xc
mov dword [esi], ecx
mov byte [esi + 4], dl
add esi, 4
mov byte [esi + 1], bl
mov eax, dword [ebp + 0x210]
inc esi
inc esi
sub eax, esi
sub eax, 4
mov dword [esi], eax
mov ecx, dword [ebp + 0x208]
push ecx
lea edi, [ebp + 0x21c]
add esi, 4
push edi
push esi
call fcn.10023170
mov al, byte [edi]
add esp, 0xc
cmp al, bl
je 0x1000ec39
cmp al, byte [0x10043ea1]
jne 0x1000ec44
mov edx, dword [ebp + 0x214]
sub edx, esi
add dword [esi + 1], edx
add esi, dword [ebp + 0x208]
push 0
mov byte [esi], bl
mov eax, dword [ebp + 0x214]
mov ecx, dword [ebp + 0x208]
inc esi
sub eax, esi
lea edx, [eax + ecx - 4]
push 0
mov dword [esi], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov ecx, dword [esp + 0x44]
mov edx, dword [ebp + 0x214]
lea eax, [esp + 0x44]
push eax
push ecx
push 0x19
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ebx
pop edi
pop esi
mov byte [ebp + 0x235], 1
mov al, 1
pop ebp
add esp, 0x30
ret 4
mov eax, dword [ebp + 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x30
ret 4