Function at 0x405070
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
push edi
mov dword [ebp - 0xac], 0
mov dword [ebp - 8], 0x1401d11
push 0
push 6
lea eax, [ebp - 0xa8]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.DLL_ReadProcessMemory]
test eax, eax
jne 0x4050b2
mov eax, 1
jmp 0x405374
movzx eax, byte [ebp - 0xa8]
cmp eax, 0xe8
je 0x4050ca
mov eax, 1
jmp 0x405374
mov ecx, dword [ebp - 0xa7]
mov dword [ebp - 0xc], ecx
mov edx, 0x1403257
sub edx, dword [ebp - 0xc]
cmp edx, 0x1401d16
je 0x4050ed
mov eax, 1
jmp 0x405374
mov eax, dword [0x41a0fc]
push eax
call dword [sym.imp.KERNEL32.DLL_ResetEvent]
push 2
push 0
push 0x40
lea ecx, [ebp - 0x94]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [0x41a0fc]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.DLL_DuplicateHandle]
test eax, eax
jne 0x40512b
mov eax, 1
jmp 0x405374
mov ecx, 0x1d
mov eax, 0x90909090
lea edi, [ebp - 0x90]
rep stosd dword es:[edi], eax
push str.kernel32.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov dword [ebp - 4], eax
mov byte [ebp - 0x88], 0x60
mov byte [ebp - 0x87], 0x68
mov dword [ebp - 0x86], 0x3e8
mov byte [ebp - 0x82], 0x68
mov ecx, dword [ebp - 0x94]
mov dword [ebp - 0x81], ecx
mov byte [ebp - 0x7d], 0xb8
mov edx, 0x414394
mov ecx, dword [ebp - 4]
call fcn.00404be0
mov dword [ebp - 0x7c], eax
mov word [ebp - 0x78], 0xd0ff
mov byte [ebp - 0x76], 0x3d
mov dword [ebp - 0x75], 0x102
mov byte [ebp - 0x71], 0x74
lea edx, [ebp - 0x87]
lea eax, [ebp - 0x70]
sub edx, eax
movsx ecx, dl
sub ecx, 1
mov byte [ebp - 0x70], cl
mov byte [ebp - 0x6f], 0x68
mov edx, dword [ebp - 0x94]
mov dword [ebp - 0x6e], edx
mov byte [ebp - 0x6a], 0xb8
mov edx, 0x414388
mov ecx, dword [ebp - 4]
call fcn.00404be0
mov dword [ebp - 0x69], eax
mov word [ebp - 0x65], 0xd0ff
mov byte [ebp - 0x63], 0x61
mov byte [ebp - 0x62], 0x68
mov dword [ebp - 0x61], 0x1403257
mov byte [ebp - 0x5d], 0xc3
cmp dword [0x41c17c], 0
je 0x405222
call fcn.00403a00
and eax, 0x80000000
je 0x405218
lea eax, [ebp - 0xac]
push eax
mov ecx, dword [0x41c17c]
push ecx
call fcn.00404340
add esp, 8
mov dword [0x41c17c], 0
call fcn.00403a00
and eax, 0x80000000
je 0x405246
lea edx, [ebp - 0xac]
push edx
push 0x75
call fcn.00404300
add esp, 8
mov dword [0x41c17c], eax
jmp 0x405260
push 0x40
push 0x101000
push 0x75
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_VirtualAllocEx]
mov dword [0x41c17c], eax
cmp dword [0x41c17c], 0
jne 0x405273
mov eax, 1
jmp 0x405374
lea ecx, [ebp - 0xb0]
push ecx
push 0x74
lea edx, [ebp - 0x90]
push edx
mov eax, dword [0x41c17c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
test eax, eax
jne 0x40529c
jmp 0x40531d
push 0x74
mov edx, dword [0x41c17c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_FlushInstructionCache]
lea ecx, [ebp - 0x14]
push ecx
push 0x40
push 6
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_VirtualProtectEx]
mov ecx, dword [0x41c17c]
sub ecx, 0x1401d16
mov dword [ebp - 0x98], ecx
push 0
push 4
lea edx, [ebp - 0x98]
push edx
mov eax, dword [ebp - 8]
add eax, 1
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 6
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.DLL_VirtualProtectEx]
push 6
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_FlushInstructionCache]
jmp 0x405372
cmp dword [0x41c17c], 0
je 0x40536b
call fcn.00403a00
and eax, 0x80000000
je 0x405349
lea edx, [ebp - 0xac]
push edx
mov eax, dword [0x41c17c]
push eax
call fcn.00404340
add esp, 8
jmp 0x405361
push 0x8000
push 0x75
mov ecx, dword [0x41c17c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.DLL_VirtualFreeEx]
mov dword [0x41c17c], 0
mov eax, 1
jmp 0x405374
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret