Function at 0x1002a6f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push dword [eax]
mov edi, ecx
mov dword [ebp - 0xc], edi
call fcn.1002aa30
push dword [ebp + 0xc]
mov esi, eax
mov dword [ebp - 0x10], esi
call fcn.1002aa30
push 0x50
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x68]
xorps xmm0, xmm0
push 0
push eax
movlpd qword [ebp - 0x70], xmm0
call fcn.10074d40
add esp, 0xc
lea eax, [ebp - 0x70]
push eax
push ecx
push esi
call fcn.1002af50
mov ebx, eax
push ebx
cmp ebx, 5
jae 0x1002a762
push str.DisassembleAndSkip_failed._dwInstructionLength___ld
push str.ApiHook::ApiHookImpl
push 0x22
call fcn.10041ef0
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
mov ecx, edi
call fcn.1002add0
push dword [ebp - 0x64]
mov ecx, edi
push dword [ebp - 0x68]
push dword [ebp - 0x6c]
push dword [ebp - 0x70]
push esi
call fcn.1002aac0
mov edi, eax
test edi, edi
je 0x1002a8da
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 8]
push ecx
push 0x40
push ebx
push esi
push eax
mov dword [ebp + 0xc], eax
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1002a8ba
lea eax, [ebp - 4]
push eax
push 0x40
push 0x6c
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1002a89d
xor ecx, ecx
lea eax, [edi + 0x2c]
test ebx, ebx
je 0x1002a7f7
mov edx, eax
sub esi, eax
lea ecx, [ecx]
mov al, byte [esi + edx]
mov byte [edx], al
mov byte [edi + ecx + 0x4c], al
inc ecx
lea edx, [edx + 1]
cmp ecx, ebx
jb 0x1002a7e0
mov esi, dword [ebp - 0x10]
lea eax, [edi + 0x2c]
lea edx, [ebx + 5]
lea ecx, [ebx + esi]
add edx, eax
cmp edx, ecx
jbe 0x1002a809
mov eax, edx
sub eax, ecx
jmp 0x1002a80d
mov eax, ecx
sub eax, edx
cmp eax, 0x7fff0000
ja 0x1002a821
sub ecx, edx
mov byte [edi + ebx + 0x2c], 0xe9
mov dword [edi + ebx + 0x2d], ecx
jmp 0x1002a835
lea edx, [edi + 0x2c]
lea eax, [ebx + 6]
add eax, edx
mov word [edx + ebx], 0x25ff
mov dword [edx + ebx + 2], eax
mov dword [eax], ecx
mov ecx, dword [ebp - 0x14]
cmp ecx, esi
jae 0x1002a842
mov eax, esi
sub eax, ecx
jmp 0x1002a846
mov eax, ecx
sub eax, esi
push ecx
cmp eax, 0x7fff0000
jbe 0x1002a86b
lea esi, [edi + 0xc]
push esi
call fcn.1002aa70
sub eax, edi
sub eax, 0xc
push eax
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
push esi
mov esi, dword [ebp - 0x10]
push esi
call fcn.1002aa70
mov eax, dword [ebp - 0x14]
mov dword [edi + 8], eax
push ebx
lea eax, [edi + 0x2c]
push eax
push dword [ebp + 0xc]
mov dword [edi + 4], ebx
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 0x6c
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push ebx
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push ebx
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp dword [edi], 0
mov esi, dword [ebp - 0xc]
je 0x1002a8cc
mov ecx, dword [ebp + 8]
lea eax, [edi + 0x2c]
mov dword [ecx], eax
jmp 0x1002a8dd
push 1
push edi
mov ecx, esi
call fcn.1002abb0
xor edi, edi
jmp 0x1002a8dd
mov esi, dword [ebp - 0xc]
mov ecx, esi
call fcn.1002ad40
xor eax, eax
test edi, edi
pop edi
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret 8