Function at 0x40b10e
Capabilities:
Allocate or change rwx memory

Disassembly:
xor eax, eax
sub eax, eax
add dword [ebp - 0x20], 8
mov edx, dword [ebp - 0x1c]
xor dword [ebp - 0x20], 0xffffff
and dword [ebp - 0x20], 0xffff
push 8
push 0x8000
push 0xd00
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov edi, dword [esp]
mov edi, dword [ebp]
lea eax, [ebp - 0x1c]
mov edi, dword [esp]
mov edi, eax
mov edi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x18]
lea ecx, [esp]
lea edi, [ebp]
lea esi, [esp]
lea edi, [esp]
sub dword [ebp - 0x1c], 0x55
sub edi, edi
or dword [ebp - 0x20], 0xffffffff
mov dx, 0x79
lea edx, [ebp]
mov cx, 9
mov edi, dword [ebp]
and dword [ebp - 0x20], 0x44004444
or dword [ebp - 0x18], 0xaaaa
mov eax, dword [esp]
add dword [ebp - 0x1c], 0x33003333
xor dword [ebp - 0x1c], 0xdd
mov edi, 0xc8
or dword [ebp - 0x18], 0xaa
mov ax, 1
sub dword [ebp - 0x18], 0x333333
sub dword [ebp - 0x20], 0x88880088
mov edi, edx
sub esi, esi
mov edx, esi
and dword [ebp - 0x1c], 0xdddddddd
or dword [ebp - 0x1c], 0x33333333
call dword [sym.imp.KERNEL32.DLL_GetACP]
mov dword [ebp - 0x1c], edx
mov edi, dword [esp]
mov edi, dword [esp]
lea esi, [ebp]
mov edi, dword [esp]
lea eax, [ebp - 0x18]
mov esi, dword [ebp]
mov ecx, dword [ebp]
sub edi, edi
mov dword [ebp - 0x1c], edi
lea edi, [esp]
lea edx, [ebp - 0x18]
lea ecx, [esp]
mov edi, dword [ebp]
mov ecx, dword [esp]
and dword [ebp - 0x18], 0x33
sub esi, esi
xor dword [ebp - 0x1c], 0x11110011
mov dx, 0x59
mov esi, dword [ebp]
and dword [ebp - 0x1c], 0x99000099
and dword [ebp - 0x1c], 0x440044
lea edi, [esp]
mov eax, dword [ebp - 0x18]
sub edi, edi
mov dword [ebp - 0x1c], edi
and dword [ebp - 0x18], 0xffff
mov edi, 2
mov edi, dword [esp]
sub edi, edi
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x20], 0x43
xor edx, edx
sub dword [ebp - 0x1c], 2
cmp edx, dword [ebp - 0x1c]
jbe 0x40b254
xor ecx, ecx
cmp ecx, 0
jbe 0x40b254
call dword [sym.imp.KERNEL32.DLL_GetACP]
mov dx, 0xf5
mov ax, 0xc6
mov esi, edi
lea eax, [ebp - 0x18]
mov edx, edi
lea edx, [esp]
lea ecx, [ebp - 0x18]
mov edi, edx
mov edi, dword [esp]
mov ecx, esi
mov dword [ebp - 0x18], eax
sub edi, edi
mov esi, 0x84
and dword [ebp - 0x1c], 0x55000055
mov eax, dword [ebp]
mov edx, dword [esp]
mov edi, dword [esp]
xor dword [ebp - 0x1c], 0xcccccc
lea edi, [ebp - 0x20]
lea ecx, [ebp - 0x1c]
mov edx, dword [esp]
and dword [ebp - 0x18], 0xaa00aa
mov cx, 0x80
lea edi, [ebp]
lea eax, [esp]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x20], 0x9e
sub dword [ebp - 0x1c], 0x22220022
sub dword [ebp - 0x18], 0x33330033
mov di, 0x50
mov esi, dword [ebp - 0x20]
lea edx, [esp]
mov eax, 0x300
xor dword [ebp - 0x20], 0xff00ff
sub eax, eax
and dword [ebp - 0x18], 0xff00ff
mov eax, 0x58
sub eax, eax
test eax, eax
je 0x40b314
xor dword [ebp - 0x1c], 0xffffff
mov ecx, 0
and dword [ebp - 0x20], 0xffff
mov dword [ebp - 0x20], 0x40
or dword [ebp - 0x20], 0xffff
push 2
push 0x8000
push 0x600
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov edi, 0xa3
mov ecx, 8
lea esi, [ebp]
mov edi, dword [esp]
mov edi, ecx
mov edi, eax
lea esi, [ebp - 0x20]
lea edx, [esp]
and dword [ebp - 0x1c], 0xaaaa00aa
mov edx, dword [ebp - 0x1c]
and dword [ebp - 0x1c], 0x77007777
xor eax, eax
mov di, 4
mov eax, 0x56
lea edi, [ebp]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
xor dword [ebp - 0x20], 0x440044
sub dword [ebp - 0x18], 0x9999
mov esi, dword [esp]
mov dword [ebp - 0x18], esi
sub ecx, ecx
mov edi, dword [ebp - 0x20]
sub dword [ebp - 0x20], 0xbbbbbb
xor edi, edi
or dword [ebp - 0x1c], 0x55005555
xor edi, edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], edi
add dword [ebp - 0x20], 0xdd0000dd
lea edx, [esp]
mov dword [ebp - 0x18], 0x10
push 2
push 0x8000
push 0x800
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov eax, dword [esp]
mov dword [ebp - 0x18], ecx
mov edi, dword [ebp - 0x18]
lea edi, [esp]
lea esi, [ebp]
mov edi, dword [ebp - 0x20]
mov esi, eax
mov edi, dword [ebp]
xor edi, edi
lea edi, [esp]
mov edi, 0x80
sub edi, edi
lea edi, [esp]
lea edi, [ebp]
mov eax, dword [ebp]
and dword [ebp - 0x1c], 0x880088
and dword [ebp - 0x1c], 0x770077
lea eax, [esp]
mov ecx, dword [ebp]
add dword [ebp - 0x18], 0x33333333
lea esi, [ebp - 0x1c]
xor dword [ebp - 0x20], 0x7777
xor eax, eax
lea edi, [ebp]
mov edi, dword [ebp - 0x20]
mov dx, 0x66
mov dword [ebp - 0x20], 0xa3
mov dword [ebp - 0x1c], 0xc3
mov edi, dword [ebp]
mov edi, 0x9f
sub esi, esi
mov edi, dword [ebp]
mov edi, dword [ebp]
mov esi, dword [ebp]
mov eax, dword [ebp - 0x20]
sub dword [ebp - 0x18], 1
cmp dword [ebp - 0x20], eax
jae 0x40b45c
mov edx, 0x64
mov dword [ebp - 0x1c], edx
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
and dword [ebp - 0x20], 0xff00ff
lea edx, [ebp - 0x20]
call dword [sym.imp.KERNEL32.DLL_GetACP]
mov edi, edx
mov di, 0xbe
mov dx, 0xf3
lea eax, [ebp - 0x1c]
mov edx, 0x37
mov esi, dword [esp]
mov edx, 0x33
mov dword [ebp - 0x18], edi
mov esi, eax
lea edi, [esp]
mov ecx, dword [ebp]
sub dword [ebp - 0x18], 0x22222222
lea edx, [esp]
mov edx, edi
sub esi, esi
mov esi, dword [ebp - 0x18]
mov esi, dword [ebp]
mov ecx, eax
add dword [ebp - 0x18], 0xdddddddd
mov edi, dword [ebp - 0x20]
mov dx, 4
mov edi, dword [ebp]
mov eax, dword [ebp]
lea eax, [ebp]
xor ecx, ecx
xor esi, esi
mov ecx, dword [esp]
mov si, 8
sub dword [ebp - 0x18], 0x11110011
mov ecx, edi
mov dword [ebp - 0x18], edi
mov edx, dword [ebp - 0x1c]
add dword [ebp - 0x1c], 0x330033
lea eax, [ebp - 0x20]
sub eax, eax
sub ecx, ecx
sub dword [ebp - 0x18], 0x10
sub ecx, ecx
sub ecx, ecx
push 8
push 0x2000
push 0x700
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
lea eax, [ebp]
lea edi, [ebp]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x20], edi
lea eax, [esp]
mov dword [ebp - 0x20], eax
mov cx, 0x22
mov dword [ebp - 0x20], esi
mov esi, dword [ebp - 0x18]
mov eax, 1
sub edx, edx
mov dword [ebp - 0x20], 0xdf
mov esi, ecx
mov esi, eax
or dword [ebp - 0x18], 0xaaaa00aa
lea edx, [ebp - 0x18]
xor edi, edi
add dword [ebp - 0x20], 0x22220022
mov dword [ebp - 0x20], edi
and dword [ebp - 0x1c], 0x880088
mov ecx, dword [ebp - 0x18]
and dword [ebp - 0x20], 0xcccccc
mov dword [ebp - 0x20], esi
sub edi, edi
and dword [ebp - 0x1c], 0x66666666
mov edi, dword [esp]
xor edi, edi
lea edi, [ebp]
lea esi, [ebp]
lea edi, [ebp]
sub dword [ebp - 0x18], 0xeeeeeeee
and dword [ebp - 0x20], 0xaa0000aa
lea edi, [ebp - 0x20]
sub ecx, ecx
mov edx, 0x12c
sub edx, edx
mov edx, 1
mov dx, 8
xor dword [ebp - 0x1c], 0xffffff
add dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
xor eax, eax
xor eax, eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.DLL_GetACP]
lea edi, [esp]
mov esi, dword [ebp]
mov eax, 0x38
mov esi, dword [ebp - 0x20]
mov edx, dword [ebp]
mov dword [ebp - 0x18], ecx
lea edi, [ebp - 0x18]
mov edi, dword [ebp - 0x20]
mov edi, dword [ebp - 0x18]
lea esi, [ebp]
or dword [ebp - 0x20], 0xdd
mov dword [ebp - 0x20], edi
add dword [ebp - 0x20], 0x440044
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 8
mov edi, 4
lea eax, [ebp]
lea esi, [ebp - 0x1c]
mov di, 1
sub dword [ebp - 0x18], 0x22222222
and dword [ebp - 0x18], 0xdddddddd
xor eax, eax
xor ecx, ecx
and dword [ebp - 0x20], 0xff0000ff
or dword [ebp - 0x20], 0x8888
mov esi, 0x20
xor edx, edx
sub dword [ebp - 0x18], 0x333333
mov ecx, dword [ebp - 0x20]
mov edx, 0
or dword [ebp - 0x18], 0xffffff
push 0x445179
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
sub edx, edx
and dword [ebp - 0x18], 0xffffff
cmp edx, dword [ebp - 0x18]
ja 0x40b65e
mov ecx, dword [ebp - 0x20]
add dword [ebp - 0x20], 2
xor dword [ebp - 0x18], 0xff
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x18], ecx
jae 0x40b65e
and dword [ebp - 0x1c], 0xffff
mov edx, 0x200
and dword [ebp - 0x18], 0xffff
xor edx, edx
xor dword [ebp - 0x20], 0xffff
or dword [ebp - 0x18], 0xffffff
test edx, edx
jae 0x40b6a5
or dword [ebp - 0x1c], 0xff00ff
mov di, 0x4d
xor edi, edi
mov dword [ebp - 0x1c], 0x10
mov dword [ebp - 0x18], edx
mov di, 8
mov edi, 0x57
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.DLL_GetACP]
mov dword [ebp - 0x18], eax
mov esi, edi
mov eax, 4
mov esi, 2
mov esi, dword [esp]
lea eax, [ebp - 0x1c]
lea edx, [ebp]
mov dword [ebp - 0x1c], eax
mov di, 5
mov si, 8
and dword [ebp - 0x20], 0xcc
and dword [ebp - 0x18], 0xaaaaaa
or dword [ebp - 0x18], 0x33333333
mov dword [ebp - 0x20], 8
and dword [ebp - 0x1c], 0x888888
mov dword [ebp - 0x20], edi
and dword [ebp - 0x1c], 0x66000066
add dword [ebp - 0x20], 0x99009999
xor dword [ebp - 0x1c], 0xdd0000dd
mov esi, dword [esp]
mov edi, 0xa
sub edi, edi
mov di, 0x89
sub ecx, ecx
sub dword [ebp - 0x18], 0x11111111
lea ecx, [ebp]
lea esi, [esp]
add dword [ebp - 0x18], 0xcccc
xor dword [ebp - 0x18], 0xbbbb
call dword [sym.imp.KERNEL32.DLL_GetACP]
mov dword [ebp - 0x1c], edi
mov eax, 0x80
mov edx, 4
lea esi, [esp]
lea edi, [ebp]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp]
mov edx, dword [ebp]
lea eax, [ebp]
add dword [ebp - 0x18], 0xffffffff
xor edi, edi
add dword [ebp - 0x1c], 0x88888888
and dword [ebp - 0x1c], 0x55
mov edi, ecx
mov eax, esi
xor dword [ebp - 0x18], 0x440044
xor dword [ebp - 0x18], 0xbb00bbbb
mov ecx, dword [esp]
mov si, 0x60
and dword [ebp - 0x1c], 0xff
mov edi, esi
mov edx, eax
and dword [ebp - 0x18], 0xff00ffff
mov edx, dword [ebp]
and dword [ebp - 0x20], 0xcccc
lea esi, [ebp - 0x1c]
and dword [ebp - 0x1c], 0xbbbbbb
mov ecx, dword [ebp]
xor eax, eax
mov ecx, dword [esp]
lea eax, [esp]
sub dword [ebp - 0x18], 0x111111
or dword [ebp - 0x20], 0x8888
mov esi, dword [esp]
xor ecx, ecx
xor dword [ebp - 0x18], 0xff
mov dword [ebp - 0x18], ecx
cmp ecx, dword [ebp - 0x20]
jae 0x40b7e7
sub edx, edx
xor dword [ebp - 0x18], 0xff
cmp ecx, dword [ebp - 0x1c]
jne 0x40b7e7
lea esi, [ebp - 0x18]
push esi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov edi, dword [ebp]
lea eax, [ebp - 0x18]
mov edi, 1
lea edx, [ebp - 0x20]
lea edi, [ebp - 0x20]
mov dword [ebp - 0x1c], eax
lea edi, [ebp - 0x18]
mov di, 0x85
mov eax, edi
xor dword [ebp - 0x1c], 0x22000022
sub dword [ebp - 0x20], 0x5555
mov esi, 0x9a
lea ecx, [ebp - 0x18]
lea ecx, [ebp - 0x1c]
and dword [ebp - 0x20], 0x4444
sub ecx, ecx
sub dword [ebp - 0x1c], 0xbb00bb
lea edx, [esp]
sub dword [ebp - 0x20], 0x110011
mov esi, dword [esp]
lea eax, [esp]
mov edi, dword [ebp]
sub dword [ebp - 0x18], 0x990099
xor esi, esi
xor dword [ebp - 0x18], 0x55000055
and dword [ebp - 0x1c], 0x2222
xor edx, edx
lea edi, [ebp]
or dword [ebp - 0x1c], 0x88008888
mov di, 0x51
mov dword [ebp - 0x18], edx
xor ecx, ecx
add dword [ebp - 0x1c], 0x33
lea edx, [ebp - 0x20]
xor eax, eax
and dword [ebp - 0x20], 0xff00ff
lea ecx, [ebp - 0x20]
test eax, eax
jbe 0x40b8ab
mov ecx, pe_nt_image_headers32
xor dword [ebp - 0x18], 0xffff
mov ax, 2
and dword [ebp - 0x18], 0xffff
or dword [ebp - 0x18], 0xffff
push 4
push 0x4000
push 0x300
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov edi, dword [ebp]
mov esi, 0x95
mov dx, 0x80
mov dword [ebp - 0x20], edx
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], edx
mov eax, ecx
lea edx, [ebp - 0x1c]
add dword [ebp - 0x20], 0xbb00bbbb
mov ax, 0x9a
xor ecx, ecx
mov dword [ebp - 0x20], esi
mov eax, dword [ebp]
mov esi, edx
and dword [ebp - 0x1c], 0xee00eeee
mov esi, 2
lea edi, [ebp - 0x18]
lea eax, [ebp - 0x20]
mov edi, dword [ebp - 0x20]
or dword [ebp - 0x20], 0x77777777
mov cx, 4
mov dword [ebp - 0x20], edi
and dword [ebp - 0x20], 0xcccc
and dword [ebp - 0x20], 0x110011
xor dword [ebp - 0x1c], 0xcccc
sub dword [ebp - 0x1c], 0x77007777
add dword [ebp - 0x1c], 0xee
sub esi, esi
sub edi, edi
lea edx, [esp]
mov dword [ebp - 0x18], 4
mov edi, dword [ebp - 0x1c]
mov esi, 2
mov edi, dword [ebp]
push 8
push 0x8000
push pe_nt_image_headers32
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov di, 4
mov edi, dword [ebp]
mov edi, dword [ebp]
mov ecx, 0x58
mov eax, dword [ebp]
mov ecx, dword [ebp - 0x20]
mov edi, dword [esp]
mov dword [ebp - 0x1c], edx
mov ecx, 0x80
lea eax, [ebp - 0x20]
and dword [ebp - 0x1c], 0x999999
lea esi, [ebp]
add dword [ebp - 0x1c], 0x666666
mov edx, esi
lea edi, [ebp]
sub ecx, ecx
lea edi, [ebp]
xor dword [ebp - 0x20], 0xcc00cccc
and dword [ebp - 0x18], 0x3333
sub dword [ebp - 0x1c], 0x880088
or dword [ebp - 0x1c], 0xaa00aaaa
lea eax, [esp]
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x1c], 0x44000044
and dword [ebp - 0x18], 0x33003333
lea esi, [ebp - 0x18]
add dword [ebp - 0x20], 0x99000099
mov ecx, dword [esp]
mov edi, 0x20
xor dword [ebp - 0x18], 0xffffff
lea esi, [ebp]
sub eax, eax
mov dword [ebp - 0x20], eax
sub dword [ebp - 0x18], 2
mov dword [ebp - 0x20], 0x40
mov ecx, 0
call dword [sym.imp.KERNEL32.DLL_GetACP]
lea ecx, [ebp]
mov ecx, dword [ebp]
mov esi, dword [ebp]
mov edi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x1c], esi
mov edi, dword [ebp - 0x20]
mov edi, dword [esp]
mov edi, eax
sub esi, esi
xor dword [ebp - 0x1c], 0x11001111
sub ecx, ecx
lea ecx, [ebp - 0x18]
xor eax, eax
sub ecx, ecx
mov edi, eax
mov edi, dword [ebp - 0x20]
sub dword [ebp - 0x1c], 0x44000044
lea edx, [esp]
xor edi, edi
mov dword [ebp - 0x20], ecx
mov esi, dword [ebp - 0x18]
mov edi, dword [esp]
xor edx, edx
and dword [ebp - 0x1c], 0x99990099
lea esi, [ebp]
lea ecx, [ebp]
mov ecx, dword [ebp]
mov dword [ebp - 0x20], 4
sub dword [ebp - 0x1c], 0xdddd
mov edi, dword [ebp]
and dword [ebp - 0x1c], 0x5555
mov edx, dword [ebp - 0x1c]
mov ecx, 0x200
or dword [ebp - 0x20], 0xff00ff
and dword [ebp - 0x18], 0xff
sub dword [ebp - 0x18], 2
xor dword [ebp - 0x20], 0xff
call dword [sym.imp.KERNEL32.DLL_GetACP]
mov edx, dword [ebp - 0x1c]
lea edi, [ebp - 0x20]
mov dx, 0x9c
mov si, 2
lea esi, [ebp]
mov dword [ebp - 0x18], edi
mov si, 0x20
mov ecx, dword [ebp - 0x1c]
lea eax, [esp]
mov edi, 0x35
xor eax, eax
sub eax, eax
mov esi, dword [ebp - 0x1c]
sub edi, edi
and dword [ebp - 0x18], 0x11
mov edx, dword [ebp]
mov edi, 0x40
sub dword [ebp - 0x1c], 0xcccc00cc
xor edi, edi
mov dword [ebp - 0x1c], esi
sub dword [ebp - 0x18], 0x22220022
mov ecx, dword [ebp]
lea edi, [ebp]
mov cx, 0x39
mov si, 0x13
xor edx, edx
or dword [ebp - 0x18], 0x99999999
or dword [ebp - 0x18], 0x44000044
mov eax, dword [ebp - 0x1c]
and dword [ebp - 0x1c], 0xffff
cmp eax, 0xdc
jae 0x40bb30
mov ecx, 0xc8
sub dword [ebp - 0x18], 0x80
xor eax, eax
and dword [ebp - 0x1c], 0xffff
call dword [sym.imp.KERNEL32.DLL_GetACP]
lea eax, [ebp]
mov dword [ebp - 0x1c], esi
lea esi, [ebp]
lea ecx, [ebp - 0x1c]
mov esi, dword [esp]
lea edx, [ebp]
mov cx, 1
lea edx, [ebp - 0x18]
mov di, 0x64
and dword [ebp - 0x20], 0xdddd00dd
mov edi, dword [ebp - 0x18]
and dword [ebp - 0x20], 0x77000077
and dword [ebp - 0x1c], 0x22002222
xor dword [ebp - 0x1c], 0xff
sub dword [ebp - 0x20], 0x55000055
mov dword [ebp - 0x1c], 0xe
lea eax, [ebp - 0x18]
xor ecx, ecx
mov ecx, edi
and dword [ebp - 0x1c], 0xff0000ff
and dword [ebp - 0x1c], 0x77777777
xor dword [ebp - 0x20], 0xeeee
mov edi, 8
mov eax, 0x6c
lea edx, [ebp - 0x18]
sub dword [ebp - 0x1c], 0x44
or dword [ebp - 0x1c], 0xcc
mov esi, eax
and dword [ebp - 0x20], 0x22220022
mov dword [ebp - 0x20], esi
sub ecx, ecx
mov edx, 0x200
ret