Function at 0x10001930
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
cmp dword [ebp + 8], 0
jne 0x1000194a
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 4], ecx
jmp 0x100019b4
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x50], eax
mov edx, dword [ebp - 0x20]
cmp dword [edx + 0x50], 0
jne 0x1000198d
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x50], eax
mov edx, dword [ebp - 0x20]
cmp dword [edx + 0x50], 0
jne 0x10001983
xor eax, eax
jmp 0x10001b88
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x4c], 1
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x20]
cmp dword [edx + 4], 0
jne 0x100019b4
xor eax, eax
jmp 0x10001b88
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
mov edx, dword [ebp - 0x20]
cmp dword [edx], 0
jne 0x100019ce
xor eax, eax
jmp 0x10001b88
push 0x1c
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
lea edx, [ebp - 8]
push edx
push 0x40
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x10001b86
push 0x10023388
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x10001ae5
mov edx, dword [ebp - 0x20]
mov byte [edx + 0x48], 6
mov eax, dword [ebp - 0x20]
movzx ecx, byte [eax + 0x48]
push ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0x20]
add ecx, 8
push ecx
call sub.MSVCR71.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 0x20]
movzx eax, byte [edx + 0x48]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 0x20]
add eax, 0x28
push eax
call sub.MSVCR71.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp - 0x20]
mov byte [ecx + 0x28], 0xe9
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp + 0x10]
sub eax, dword [edx + 4]
sub eax, 5
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x29], eax
mov edx, dword [ebp - 0x20]
mov byte [edx + 0x2d], 0x90
mov eax, dword [ebp - 0x20]
mov byte [eax + 0xe], 0xe9
mov ecx, dword [ebp - 0x20]
add ecx, 8
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 4]
sub eax, ecx
sub eax, 5
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0xf], eax
mov edx, dword [ebp - 0x20]
movzx eax, byte [edx + 0x48]
push eax
mov ecx, dword [ebp - 0x20]
add ecx, 0x28
push ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 4]
push eax
call sub.MSVCR71.dll_memcpy
add esp, 0xc
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, 1
jmp 0x10001b88
push 0
push 5
mov ecx, dword [ebp - 0x20]
add ecx, 8
push ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x10001b86
mov eax, dword [ebp - 0x20]
mov byte [eax + 0x48], 5
mov ecx, dword [ebp - 0x20]
mov byte [ecx + 0x28], 0xe9
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp + 0x10]
sub eax, dword [edx + 4]
sub eax, 5
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x29], eax
mov edx, dword [ebp - 0x20]
mov byte [edx + 0xd], 0xe9
mov eax, dword [ebp - 0x20]
add eax, 8
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 4]
sub edx, eax
sub edx, 5
mov eax, dword [ebp - 0x20]
mov dword [eax + 0xe], edx
mov ecx, dword [ebp - 0x20]
movzx edx, byte [ecx + 0x48]
push edx
mov eax, dword [ebp - 0x20]
add eax, 0x28
push eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 4]
push edx
call sub.MSVCR71.dll_memcpy
add esp, 0xc
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, 1
jmp 0x10001b88
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc