Function at 0x4498f0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
test dl, dl
je 0x449905
add esp, 0xfffffff0
call fcn.004030a8
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 8], edx
push ebp
push 0x449c20
push dword fs:[0]
mov dword fs:[0], esp
mov dl, 1
mov eax, dword [0x40c940]
call fcn.00402d78
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.0040f754
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push 4
push 0x1000
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x50]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x54]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
call fcn.00406c3c
mov eax, dword [ebp - 0x18]
add eax, 4
add eax, 0x14
mov edx, dword [ebp - 0x1c]
movzx edx, word [edx + 0x14]
add eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 6]
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jb 0x449a07
inc ebx
xor esi, esi
mov edi, esi
shl edi, 3
lea edi, [edi + edi*4]
add edi, dword [ebp - 0x18]
mov eax, dword [edi + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [edi + 0xc]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
call fcn.00406c44
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
call fcn.004498e8
mov ecx, eax
mov edx, dword [edi + 0x14]
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
call fcn.00406c3c
inc esi
dec ebx
jne 0x4499bd
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
sub edx, dword [eax + 0x34]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xa0]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x3c]
jmp 0x449a6b
mov ecx, dword [edx + 4]
sub ecx, 8
shr ecx, 1
add eax, 8
mov ebx, ecx
dec ebx
test ebx, ebx
jb 0x449a69
inc ebx
test byte [eax + 1], 0xf0
je 0x449a63
mov ecx, dword [edx]
add ecx, dword [ebp - 0x20]
mov si, word [eax]
and si, 0xfff
movzx esi, si
add ecx, esi
mov esi, dword [ebp - 0x34]
add dword [ecx], esi
add eax, 2
dec ebx
jne 0x449a46
mov edx, eax
mov ecx, dword [ebp - 0x38]
add ecx, dword [ebp - 0x3c]
mov eax, edx
cmp ecx, eax
ja 0x449a33
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x80]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov dl, 1
mov eax, dword [0x40c394]
call fcn.00402d78
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
jmp 0x449b34
mov ebx, dword [ebp - 0x20]
add eax, ebx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
je 0x449acb
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x4c]
call fcn.0040d8fc
mov eax, dword [ebp - 0x44]
cmp dword [eax + 4], 0
jne 0x449ae0
mov eax, dword [ebp - 0x44]
mov eax, dword [eax + 0x10]
add eax, ebx
mov ebx, eax
jmp 0x449b25
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
add eax, ebx
mov ebx, eax
jmp 0x449b25
test eax, 0x80000000
je 0x449afc
mov esi, eax
and esi, 0xffff
jmp 0x449b02
add eax, dword [ebp - 0x20]
lea esi, [eax + 2]
mov ecx, esi
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi]
test eax, eax
je 0x449b16
mov dword [ebx], eax
jmp 0x449b22
push esi
mov eax, dword [ebp - 0x4c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebx], eax
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x449aeb
mov eax, dword [ebp - 0x44]
add eax, 0x14
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x449aa3
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jb 0x449be4
inc ebx
xor esi, esi
mov edx, esi
shl edx, 3
lea edx, [edx + edx*4]
add edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x24]
xor edi, edi
test eax, 0x4000000
je 0x449b6d
or eax, 0x200
test eax, 0x20000000
je 0x449ba0
test eax, 0x40000000
je 0x449b8c
test eax, 0x80000000
je 0x449b87
or edi, 0x40
jmp 0x449bc7
or edi, 0x20
jmp 0x449bc7
test eax, 0x80000000
je 0x449b9b
or edi, 0x80
jmp 0x449bc7
or edi, 0x10
jmp 0x449bc7
test eax, 0x40000000
je 0x449bb8
test eax, 0x80000000
je 0x449bb3
or edi, 4
jmp 0x449bc7
or edi, 2
jmp 0x449bc7
test eax, 0x80000000
je 0x449bc4
or edi, 8
jmp 0x449bc7
or edi, 1
lea eax, [ebp - 0x50]
push eax
push edi
mov eax, dword [edx + 8]
push eax
mov eax, dword [edx + 0xc]
add eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_VirtualProtect
inc esi
dec ebx
jne 0x449b51
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x28]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x449c01
push 0
push 1
mov eax, dword [ebp - 0x20]
push eax
call dword [ebp - 0x54]
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x20]
mov dword [eax + 4], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449c27
mov eax, dword [ebp - 0x10]
call fcn.00402da8
ret