Function at 0x40401c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [0x410270]
mov dword [ebp - 0x2f0], eax
mov dword [ebp - 0x2ec], 0
call fcn.004044cd
sub eax, 6
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x2e8]
push edx
lea eax, [ebp - 0x1e4]
push eax
push 0
call fcn.00403d41
add esp, 0x10
test eax, eax
je 0x4044b3
push 4
push 0x1000
mov ecx, dword [ebp - 4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
push edx
mov eax, dword [0x41037c]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.0040c490
add esp, 0xc
cmp dword [0x40fde0], 0
je 0x4040b2
push 0x8000
push 0
mov edx, dword [0x41037c]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
lea eax, [ebp - 0x2e8]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x2ec]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.0040456d
add esp, 0x18
test eax, eax
jne 0x4040f4
push 0x8000
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x4044c9
push 0x8000
push 0
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x314], eax
mov dword [ebp - 0x2f4], 0x41037c
call fcn.00403ff7
mov dword [0x40ffd4], eax
mov dword [ebp - 0x304], 0x40ffd4
lea edx, [ebp - 0x10]
push edx
push 0x40
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x2f0]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x404151
xor eax, eax
jmp 0x4044c9
push 0x40
push 0x1000
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x40fdf8], eax
mov dword [ebp - 0x310], 0
mov edx, dword [0x40fdf8]
add edx, dword [ebp - 0x310]
mov byte [edx], 0x6a
mov eax, dword [ebp - 0x310]
add eax, 1
mov dword [ebp - 0x310], eax
mov ecx, dword [0x40fdf8]
add ecx, dword [ebp - 0x310]
mov byte [ecx], 0
mov edx, dword [ebp - 0x310]
add edx, 1
mov dword [ebp - 0x310], edx
mov eax, dword [0x40fdf8]
add eax, dword [ebp - 0x310]
mov byte [eax], 0x68
mov ecx, dword [ebp - 0x310]
add ecx, 1
mov dword [ebp - 0x310], ecx
push 4
lea edx, [ebp - 0xc]
push edx
mov eax, dword [0x40fdf8]
add eax, dword [ebp - 0x310]
push eax
call fcn.0040c490
add esp, 0xc
mov ecx, dword [ebp - 0x310]
add ecx, 4
mov dword [ebp - 0x310], ecx
mov edx, dword [0x40fdf8]
add edx, dword [ebp - 0x310]
mov byte [edx], 0x68
mov eax, dword [ebp - 0x310]
add eax, 1
mov dword [ebp - 0x310], eax
push 4
push 0x40ffdc
mov ecx, dword [0x40fdf8]
add ecx, dword [ebp - 0x310]
push ecx
call fcn.0040c490
add esp, 0xc
mov edx, dword [ebp - 0x310]
add edx, 4
mov dword [ebp - 0x310], edx
mov eax, dword [0x40fdf8]
add eax, dword [ebp - 0x310]
mov byte [eax], 0x68
mov ecx, dword [ebp - 0x310]
add ecx, 1
mov dword [ebp - 0x310], ecx
push 4
lea edx, [ebp - 0x2f0]
push edx
mov eax, dword [0x40fdf8]
add eax, dword [ebp - 0x310]
push eax
call fcn.0040c490
add esp, 0xc
mov ecx, dword [ebp - 0x310]
add ecx, 4
mov dword [ebp - 0x310], ecx
mov edx, dword [0x40fdf8]
add edx, dword [ebp - 0x310]
mov byte [edx], 0x68
mov eax, dword [ebp - 0x310]
add eax, 1
mov dword [ebp - 0x310], eax
push 4
lea ecx, [ebp - 0x314]
push ecx
mov edx, dword [0x40fdf8]
add edx, dword [ebp - 0x310]
push edx
call fcn.0040c490
add esp, 0xc
mov eax, dword [ebp - 0x310]
add eax, 4
mov dword [ebp - 0x310], eax
mov ecx, dword [0x40fdf8]
add ecx, dword [ebp - 0x310]
mov byte [ecx], 0xff
mov edx, dword [ebp - 0x310]
add edx, 1
mov dword [ebp - 0x310], edx
mov eax, dword [0x40fdf8]
add eax, dword [ebp - 0x310]
mov byte [eax], 0x15
mov ecx, dword [ebp - 0x310]
add ecx, 1
mov dword [ebp - 0x310], ecx
push 4
lea edx, [ebp - 0x304]
push edx
mov eax, dword [0x40fdf8]
add eax, dword [ebp - 0x310]
push eax
call fcn.0040c490
add esp, 0xc
mov ecx, dword [ebp - 0x310]
add ecx, 4
mov dword [ebp - 0x310], ecx
mov edx, dword [0x40fdf8]
add edx, dword [ebp - 0x310]
mov byte [edx], 0x8b
mov eax, dword [ebp - 0x310]
add eax, 1
mov dword [ebp - 0x310], eax
mov ecx, dword [0x40fdf8]
add ecx, dword [ebp - 0x310]
mov byte [ecx], 0xe5
mov edx, dword [ebp - 0x310]
add edx, 1
mov dword [ebp - 0x310], edx
mov eax, dword [0x40fdf8]
add eax, dword [ebp - 0x310]
mov byte [eax], 0x5d
mov ecx, dword [ebp - 0x310]
add ecx, 1
mov dword [ebp - 0x310], ecx
mov edx, dword [0x40fdf8]
add edx, dword [ebp - 0x310]
mov byte [edx], 0x8b
mov eax, dword [ebp - 0x310]
add eax, 1
mov dword [ebp - 0x310], eax
mov ecx, dword [0x40fdf8]
add ecx, dword [ebp - 0x310]
mov byte [ecx], 0xe5
mov edx, dword [ebp - 0x310]
add edx, 1
mov dword [ebp - 0x310], edx
mov eax, dword [0x40fdf8]
add eax, dword [ebp - 0x310]
mov byte [eax], 0x5d
mov ecx, dword [ebp - 0x310]
add ecx, 1
mov dword [ebp - 0x310], ecx
mov edx, dword [0x40fdf8]
add edx, dword [ebp - 0x310]
mov byte [edx], 0xe9
mov eax, dword [ebp - 0x310]
add eax, 1
mov dword [ebp - 0x310], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x2fc], ecx
mov edx, dword [0x40fdf8]
sub edx, dword [ebp - 0x2fc]
sub edx, 5
mov dword [0x40ffd0], edx
mov eax, dword [ebp - 0x2fc]
mov dword [ebp - 0x318], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
sub edx, dword [0x40fdf8]
mov eax, dword [ebp - 0x310]
add eax, 4
sub edx, eax
mov dword [ebp - 0x2f8], edx
push 4
lea ecx, [ebp - 0x2f8]
push ecx
mov edx, dword [0x40fdf8]
add edx, dword [ebp - 0x310]
push edx
call fcn.0040c490
add esp, 0xc
mov byte [ebp - 0x30c], 0xe9
push 4
push 0x40ffd0
lea eax, [ebp - 0x30b]
push eax
call fcn.0040c490
add esp, 0xc
push 0
push 5
lea ecx, [ebp - 0x30c]
push ecx
mov edx, dword [ebp - 0x318]
push edx
mov eax, dword [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x300], eax
jmp 0x4044c7
push 0x10
push 0x40146c
push 0x401474
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov esp, ebp
pop ebp
ret