Function at 0x1000d060
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10
mov ecx, dword [ebp - 4]
add ecx, 0x952e5
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp - 4]
mov byte [edx + 0x952e5], 0xeb
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0x10
mov edx, dword [ebp - 4]
add edx, 0x952e5
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10
mov ecx, dword [ebp - 4]
add ecx, 0x95552
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp - 4]
mov byte [edx + 0x95552], 0xeb
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0x10
mov edx, dword [ebp - 4]
add edx, 0x95552
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10
mov ecx, dword [ebp - 4]
add ecx, 0x9ef46
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp - 4]
mov byte [edx + 0x9ef46], 0x90
mov eax, dword [ebp - 4]
mov byte [eax + 0x9ef47], 0x90
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
push 0x10
mov eax, dword [ebp - 4]
add eax, 0x9ef46
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 8]
push ecx
push 0x40
push 0x10
mov edx, dword [ebp - 4]
add edx, 0x9ef63
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
mov byte [eax + 0x9ef63], 0x90
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x9ef64], 0x90
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
push 0x10
mov ecx, dword [ebp - 4]
add ecx, 0x9ef63
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edx, [ebp - 8]
push edx
push 0x40
push 0x10
mov eax, dword [ebp - 4]
add eax, 0x9ef6e
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x9ef6e], 0x90
mov edx, dword [ebp - 4]
mov byte [edx + 0x9ef6f], 0x90
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0x10
mov edx, dword [ebp - 4]
add edx, 0x9ef6e
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10
mov ecx, dword [ebp - 4]
add ecx, 0x8685b
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp - 4]
mov byte [edx + 0x8685b], 0x90
mov eax, dword [ebp - 4]
mov byte [eax + 0x8685c], 0x90
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
push 0x10
mov eax, dword [ebp - 4]
add eax, 0x8685b
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 8]
push ecx
push 0x40
push 0x10
mov edx, dword [ebp - 4]
add edx, 0x8686a
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
mov byte [eax + 0x8686a], 0xeb
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
push 0x10
mov eax, dword [ebp - 4]
add eax, 0x8686a
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 8]
push ecx
push 0x40
push 0x10
mov edx, dword [ebp - 4]
add edx, 0x9558a
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
mov byte [eax + 0x9558a], 0xeb
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
push 0x10
mov eax, dword [ebp - 4]
add eax, 0x9558a
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0xf00
push 0x100acef8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x1000cee0
mov ecx, dword [sym.imp.KERNEL32.dll_CreateFileW]
push ecx
call fcn.10044060
add esp, 8
mov dword [0x100acef0], eax
push 0x1000cf60
mov edx, dword [sym.imp.KERNEL32.dll_CreateFileA]
push edx
call fcn.10044060
add esp, 8
mov dword [0x100acef4], eax
xor eax, eax
mov esp, ebp
pop ebp
ret