Function at 0x40aa80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x40
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x11]
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
add eax, dword [ecx + 0x15]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 5]
mov dword [esp + 4], eax
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub esp, 0x10
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x38], 0x6c0bd4cf
mov edi, dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
jmp 0x40ab20
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx + 1]
add ecx, eax
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.00409940
mov dword [ebp - 0x38], 0xbed3fa7d
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x38]
cmp eax, 0x973aea96
jg 0x40ab40
cmp eax, 0x8f6eb2d2
jne 0x40ab20
jmp 0x40aaf9
cmp eax, 0xa458d3a8
jg 0x40ab80
cmp eax, 0x973aea97
jne 0x40ab20
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_VirtualFree]
sub esp, 0xc
mov dword [ebp - 0x38], 0xeb3c40a0
jmp 0x40ab20
cmp eax, 0xb9151ae1
jg 0x40ab93
cmp eax, 0xa458d3a9
jne 0x40ab20
jmp 0x40b0da
cmp eax, 0xbed3fa7c
jg 0x40abc8
cmp eax, 0xb9151ae2
jne 0x40ab20
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx + 1]
add ecx, eax
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.00409940
mov dword [ebp - 0x38], 0x8f6eb2d2
jmp 0x40ab20
cmp eax, 0xc11bc8e2
jg 0x40abe6
cmp eax, 0xbed3fa7d
jne 0x40ab20
mov dword [ebp - 0x38], 0x276e4e3d
jmp 0x40ab20
cmp eax, 0xdbdbd54e
jg 0x40ac04
cmp eax, 0xc11bc8e3
jne 0x40ab20
mov dword [ebp - 0x38], 0x8f6eb2d2
jmp 0x40ab20
cmp eax, 0xe07f6b19
jg 0x40ac22
cmp eax, 0xdbdbd54f
jne 0x40ab20
mov dword [ebp - 0x38], 0x76610f08
jmp 0x40ab20
cmp eax, 0xe3077be5
jg 0x40ac69
cmp eax, 0xe07f6b1a
jne 0x40ab20
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
add eax, dword [ecx + 0x11]
mov ecx, dword [ecx + 0xd]
mov edx, dword [ebp - 0x2c]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call fcn.0040a330
test eax, eax
mov eax, 0x67b099e6
js 0x40ac61
mov eax, 0x66e1be32
mov dword [ebp - 0x38], eax
jmp 0x40ab20
cmp eax, 0x7791b16e
jg 0x40acf9
cmp eax, 0x76610f07
jg 0x40ad35
cmp eax, 0x72d9ca1a
jg 0x40ad54
cmp eax, 0x6c0bd4ce
jg 0x40ad70
cmp eax, 0x6a959887
jg 0x40ad93
cmp eax, 0x67b099e5
jg 0x40adad
cmp eax, 0x66e1be31
jg 0x40adc4
cmp eax, 0x537cdf31
jg 0x40ade1
cmp eax, 0x5265b7e5
jg 0x40ae13
cmp eax, 0x48d06c9b
jg 0x40ae37
cmp eax, 0xe35f4965
jg 0x40ae5b
cmp eax, 0xe3077be6
jne 0x40ab20
mov dword [ebp - 0x38], 0x7791b16f
jmp 0x40ab20
cmp eax, 0x7791b16f
jne 0x40ab20
mov eax, dword [ebp - 0x28]
inc eax
mov ecx, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 8], 0x20
call fcn.00402740
mov eax, dword [ebp - 0x28]
mov al, byte [eax]
and al, 1
mov byte [ebp - 0xb], al
mov dword [ebp - 0x38], 0x44d2ed40
jmp 0x40ab20
cmp eax, 0x76610f08
jne 0x40ab20
cmp dword [ebp - 0x2c], 0
setne byte [ebp - 9]
mov dword [ebp - 0x38], 0x48d06c9c
jmp 0x40ab20
cmp eax, 0x72d9ca1b
jne 0x40ab20
call fcn.0040d3c0
mov dword [ebp - 0x38], 0x20affbc
jmp 0x40ab20
cmp eax, 0x6c0bd4cf
jne 0x40ab20
mov eax, 0x3808f584
cmp dword [ebp - 0x10], 0
jne 0x40ad8b
mov eax, 0x2c5a4a78
mov dword [ebp - 0x38], eax
jmp 0x40ab20
cmp eax, 0x6a959888
jne 0x40ab20
inc dword [ebp - 0x30]
mov dword [ebp - 0x38], 0x188a3d9d
jmp 0x40ab20
cmp eax, 0x67b099e6
jne 0x40ab20
mov dword [ebp - 0x38], 0x4523bf46
jmp 0x40ab20
cmp eax, 0x66e1be32
jne 0x40ab20
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x38], 0xa458d3a9
jmp 0x40ab20
cmp eax, 0x537cdf32
jne 0x40ab20
mov eax, dword [ebp - 0x28]
inc eax
mov ecx, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 8], 0x20
call fcn.00402740
mov dword [ebp - 0x38], 0x7791b16f
jmp 0x40ab20
cmp eax, 0x5265b7e6
jne 0x40ab20
mov al, byte [ebp - 0xa]
test al, al
mov eax, 0xf734a78c
jne 0x40ae2f
mov eax, 0xe07f6b1a
mov dword [ebp - 0x38], eax
jmp 0x40ab20
cmp eax, 0x48d06c9c
jne 0x40ab20
mov al, byte [ebp - 9]
test al, al
mov eax, 0x973aea97
jne 0x40ae53
mov eax, 0xeb3c40a0
mov dword [ebp - 0x38], eax
jmp 0x40ab20
cmp eax, 0xe3ce1bc9
jg 0x40aea0
cmp eax, 0xe35f4966
jne 0x40ab20
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
sub eax, dword [ecx + 1]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
mov edx, dword [edx + 0x19]
add edx, ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.00409d50
mov dword [ebp - 0x38], 0xf9198113
jmp 0x40ab20
cmp eax, 0xeb3c409f
jg 0x40aebe
cmp eax, 0xe3ce1bca
jne 0x40ab20
mov dword [ebp - 0x38], 0x4333d493
jmp 0x40ab20
cmp eax, 0xf734a78b
jg 0x40aee3
cmp eax, 0xeb3c40a0
jne 0x40ab20
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x38], 0xa458d3a9
jmp 0x40ab20
cmp eax, 0xf8ad7a99
jg 0x40af01
cmp eax, 0xf734a78c
jne 0x40ab20
mov dword [ebp - 0x38], 0xf9198113
jmp 0x40ab20
cmp eax, 0xf9198112
jg 0x40af4b
cmp eax, 0xf8ad7a9a
jne 0x40ab20
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 5]
mov edx, dword [ebp - 0x2c]
add edx, dword [eax + 1]
add eax, 0xd
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00402740
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 5]
lea eax, [eax + ecx + 0xd]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x38], 0xfbcb79d2
jmp 0x40ab20
cmp eax, 0xfbcb79d1
jg 0x40af90
cmp eax, 0xf9198113
jne 0x40ab20
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
sub eax, dword [ecx + 1]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
mov edx, dword [edx + 0x19]
add edx, ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.00409d50
mov dword [ebp - 0x38], 0x10ea99ec
jmp 0x40ab20
cmp eax, 0x20affbb
jg 0x40afae
cmp eax, 0xfbcb79d2
jne 0x40ab20
mov dword [ebp - 0x38], 0x188a3d9d
jmp 0x40ab20
cmp eax, 0x10ea99eb
jg 0x40afdd
cmp eax, 0x20affbc
jne 0x40ab20
call fcn.0040d3c0
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test al, 3
setne byte [ebp - 0xa]
mov dword [ebp - 0x38], 0x5265b7e6
jmp 0x40ab20
cmp eax, 0x188a3d9c
jg 0x40affb
cmp eax, 0x10ea99ec
jne 0x40ab20
mov dword [ebp - 0x38], 0xe07f6b1a
jmp 0x40ab20
cmp eax, 0x276e4e3c
jg 0x40b01c
cmp eax, 0x188a3d9d
jne 0x40ab20
inc dword [ebp - 0x30]
mov dword [ebp - 0x38], 0xe3ce1bca
jmp 0x40ab20
cmp eax, 0x2c5a4a77
jg 0x40b03a
cmp eax, 0x276e4e3d
jne 0x40ab20
mov dword [ebp - 0x38], 0x20affbc
jmp 0x40ab20
cmp eax, 0x3808f583
jg 0x40b05a
cmp eax, 0x2c5a4a78
jne 0x40ab20
mov esi, dword [edi]
mov dword [ebp - 0x38], 0x4523bf46
jmp 0x40ab20
cmp eax, 0x4333d492
jg 0x40b07f
cmp eax, 0x3808f584
jne 0x40ab20
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x38], 0x4333d493
jmp 0x40ab20
cmp eax, 0x4333d493
je 0x40b0a6
cmp eax, 0x44d2ed40
jne 0x40b0c3
mov al, byte [ebp - 0xb]
test al, al
mov eax, 0xc11bc8e3
jne 0x40b09e
mov eax, 0x276e4e3d
mov dword [ebp - 0x38], eax
jmp 0x40ab20
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x20]
mov eax, 0xf8ad7a9a
cmp ecx, dword [edx + 0xd]
jb 0x40b0bb
mov eax, 0xe3077be6
mov dword [ebp - 0x38], eax
jmp 0x40ab20
cmp eax, 0x4523bf46
jne 0x40ab20
mov dword [ebp - 0x38], 0x76610f08
jmp 0x40ab20
mov eax, dword [ebp - 0x14]
add esp, 0x40
pop esi
pop edi
pop ebp
ret