Function at 0x428490
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [0x4da480]
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
test eax, eax
je 0x4284b0
cmp dword [eax + 4], 0
jne 0x4285b5
mov eax, dword [eax]
test eax, eax
jne 0x4284a0
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x428681
lea edx, [eax + 0x20]
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov esi, 0x20
mov ecx, dword [eax + 4]
add esi, 0x20
mov dword [edx], ecx
mov dword [eax + 4], edx
add edx, 0x20
cmp esi, 0xfe0
jbe 0x4284e2
mov ecx, dword [0x4da480]
mov dword [eax], ecx
mov dword [0x4da480], eax
mov ebp, dword [eax + 4]
mov ebx, dword [esp + 0x40]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ebp
mov ecx, dword [ebp]
inc dword [eax + 8]
mov dword [eax + 4], ecx
lea ecx, [esp + 0x18]
mov eax, dword [esp + 0x44]
mov dword [esp + 0x1c], eax
call fcn.00428720
test eax, eax
je 0x42867a
push 0x28
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x42867a
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
and edi, 0xf
mov ecx, dword [esp + 0x30]
mov dword [esi], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 8], eax
mov eax, edx
and eax, 1
shl edi, 3
or edi, eax
mov dword [esi + 0x1c], ecx
mov eax, dword [esi + 0x14]
mov ecx, dword [esp + 0x38]
and eax, 0xffffff80
or edi, eax
mov dword [esi + 0x24], ecx
mov eax, dword [esp + 0x2c]
mov dword [esi + 0x18], eax
mov eax, dword [esp + 0x34]
mov dword [esi + 0x14], edi
mov dword [esi + 0x20], eax
test edx, edx
je 0x4285c5
mov eax, dword [ebx - 5]
mov dword [esi + 0xc], eax
mov ax, word [ebx - 1]
mov word [esi + 0x10], ax
mov al, byte [ebx + 1]
mov byte [esi + 0x12], al
jmp 0x4285d0
test eax, eax
jne 0x428505
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
mov eax, dword [ebx]
mov dword [esi + 0xc], eax
mov al, byte [ebx + 4]
mov byte [esi + 0x10], al
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
shl edi, 0x1f
sar edi, 0x1f
test edi, edi
lea ebx, [eax - 5]
cmove ebx, eax
xor eax, eax
test edi, edi
push ecx
setne al
push 0x40
lea eax, [eax*2 + 5]
push eax
push ebx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x428622
mov ecx, ebp
call fcn.00428420
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
mov eax, dword [esp + 0x1c]
sub eax, ebx
mov byte [ebx], 0xe9
sub eax, 5
mov dword [ebx + 1], eax
test edi, edi
je 0x42863e
mov eax, dword [esp + 0x18]
mov word [eax], 0xf9eb
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, dword [esp + 0x48]
test eax, eax
je 0x428670
mov ecx, dword [esp + 0x20]
mov dword [eax], ecx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
mov ecx, ebp
call fcn.00428420
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2c
ret