Function at 0x10d942c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x150], edx
mov edi, eax
xor eax, eax
push ebp
push 0x10d976c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0x40
push 0x1000
push 0x1000
push 0
mov eax, dword [edi + 4]
mov eax, dword [eax + 0x128]
push eax
call sub.KERNEL32.DLL_VirtualAllocEx
mov esi, eax
test esi, esi
je 0x10d9743
push 0x10d977c
push 0x10d9798
call sub.KERNEL32.DLL_GetModuleHandleW
push eax
call fcn.0100c1e8
mov dword [ebp - 8], eax
push 0x10d97b4
push 0x10d9798
call sub.KERNEL32.DLL_GetModuleHandleW
push eax
call fcn.0100c1e8
mov byte [ebp - 0x141], 0x60
mov byte [ebp - 0x140], 0x68
lea edx, [ebp - 0x10d]
lea ecx, [ebp - 0x141]
sub edx, ecx
add edx, esi
mov dword [ebp - 0x13f], edx
mov byte [ebp - 0x13b], 0xe8
lea edx, [ebp - 0x13b]
lea ecx, [ebp - 0x141]
sub edx, ecx
mov ecx, dword [ebp - 8]
sub ecx, esi
sub ecx, edx
sub ecx, 5
mov dword [ebp - 0x13a], ecx
mov word [ebp - 0x136], 0xf88b
mov byte [ebp - 0x134], 0x50
mov byte [ebp - 0x133], 0x57
mov byte [ebp - 0x132], 0xe8
lea edx, [ebp - 0x132]
lea ecx, [ebp - 0x141]
sub edx, ecx
sub eax, esi
sub eax, edx
sub eax, 5
mov dword [ebp - 0x131], eax
mov byte [ebp - 0x12d], 0x61
lea eax, [ebp - 0x12c]
mov edx, 0x10d97e0
call fcn.010141e4
lea eax, [ebp - 0x123]
mov edx, 0x10d97f8
call fcn.010141e4
lea eax, [ebp - 0x11c]
mov edx, 0x10d980c
call fcn.010141e4
lea edx, [ebp - 0x150]
xor eax, eax
call fcn.010045bc
mov eax, dword [ebp - 0x150]
lea edx, [ebp - 0x14c]
call fcn.01013e5c
lea eax, [ebp - 0x14c]
mov edx, 0x10d9828
call fcn.01006f7c
mov edx, dword [ebp - 0x14c]
lea eax, [ebp - 0x148]
mov ecx, 0
call fcn.01006dac
mov edx, dword [ebp - 0x148]
lea eax, [ebp - 0x10d]
call fcn.010141e4
push 0x139
lea ecx, [ebp - 0x141]
mov edx, esi
mov eax, dword [edi + 4]
call fcn.0110b6e4
test al, al
je 0x10d9729
mov eax, dword [edi + 4]
mov edx, dword [eax + 0xbc]
mov dword [ebp - 4], edx
mov dword [eax + 0xbc], esi
call fcn.0110b234
mov eax, dword [edi + 4]
call fcn.0110b234
mov eax, dword [edi + 4]
call fcn.0110b234
mov eax, dword [edi + 4]
cmp dword [eax + 0xb4], 0
je 0x10d96e7
call fcn.0110b20c
lea edx, [ebp - 0x12c]
lea ecx, [ebp - 0x141]
sub edx, ecx
add edx, esi
mov eax, dword [edi + 4]
mov dword [eax + 0xb4], edx
call fcn.0110b20c
mov eax, dword [edi + 4]
call fcn.0110b20c
mov eax, dword [edi + 4]
call fcn.0110b234
mov eax, dword [edi + 4]
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x10d9657
mov dword [edi + 0xc], eax
mov eax, dword [edi + 4]
sub dword [eax + 0xbc], 7
lea edx, [ebp - 0x123]
lea ecx, [ebp - 0x141]
sub edx, ecx
add edx, esi
mov eax, dword [edi + 4]
mov dword [eax + 0xb4], edx
call fcn.0110b20c
mov eax, dword [edi + 4]
call fcn.0110b20c
mov eax, dword [edi + 4]
call fcn.0110b234
mov eax, dword [edi + 4]
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x10d969f
mov dword [edi + 8], eax
mov eax, dword [edi + 4]
sub dword [eax + 0xbc], 7
lea edx, [ebp - 0x11c]
lea ecx, [ebp - 0x141]
sub edx, ecx
add edx, esi
mov eax, dword [edi + 4]
mov dword [eax + 0xb4], edx
call fcn.0110b20c
mov eax, dword [edi + 4]
call fcn.0110b20c
mov eax, dword [edi + 4]
call fcn.0110b234
mov eax, dword [edi + 4]
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x10d96e7
mov dword [edi + 0x10], eax
lea edx, [esi + 0x14]
mov eax, dword [edi + 4]
mov dword [eax + 0xbc], edx
call fcn.0110b20c
mov eax, dword [edi + 4]
mov edx, dword [ebp - 4]
mov dword [eax + 0xbc], edx
cmp dword [edi + 8], 0
je 0x10d9716
cmp dword [edi + 0xc], 0
je 0x10d9716
cmp dword [edi + 0x10], 0
jne 0x10d9727
xor eax, eax
mov dword [edi + 8], eax
xor eax, eax
mov dword [edi + 0xc], eax
xor eax, eax
mov dword [edi + 0x10], eax
jmp 0x10d9729
mov bl, 1
push 0x8000
push 0x1000
push esi
mov eax, dword [edi + 4]
mov eax, dword [eax + 0x128]
push eax
call sub.KERNEL32.DLL_VirtualFreeEx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10d9773
lea eax, [ebp - 0x150]
mov edx, 2
call fcn.01006b60
lea eax, [ebp - 0x148]
call fcn.01006134
ret