Function at 0x403259
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x18], eax
add dword [ebp - 0x18], ecx
push ebx
xor ebx, ebx
xor ecx, ecx
sub dword [ebp - 0x18], ebx
add ebx, ecx
add dword [ebp - 0x18], ecx
or ecx, eax
and dword [ebp - 0x18], ecx
mov dword [ebp - 4], ecx
add dword [ebp - 4], eax
and dword [ebp - 4], ecx
add eax, eax
add dword [ebp - 0x18], ecx
or eax, ebx
add dword [ebp - 0x18], eax
push esi
mov esi, dword [ebp - 0x18]
sub dword [ebp - 0x18], esi
push edi
xor ecx, ecx
mov edi, ebx
add dword [ebp - 4], edi
or dword [ebp - 4], esi
sub ebx, ecx
add ebx, esi
test ebx, 0xa7
jne 0x4032d8
xor eax, eax
add dword [ebp - 0x18], eax
mov edi, dword [ebp - 4]
or dword [ebp - 0x18], edi
or ebx, edi
add ebx, ebx
cmp ebx, dword [ebp - 4]
jne 0x4032d8
and dword [ebp - 4], eax
lea edi, [esi*4 + 0xea]
xor esi, esi
add dword [ebp - 4], eax
sub dword [ebp - 4], esi
add dword [ebp - 0x18], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], esi
push pe_nt_image_headers32
push 0x3000
push 0x1a68
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov ebx, dword [ebp - 0x18]
mov edi, eax
cmp ebx, dword [ebp - 0x24]
jne 0x403318
sub ebx, esi
sub ebx, esi
lea ecx, [eax + 0x6688e01d]
mov edx, esi
add dword [ebp - 0x24], ecx
sub ebx, edx
add dword [ebp - 4], ebx
sub dword [ebp - 0x24], ebx
cmp edi, dword [ebp - 0x24]
je 0x403318
add dword [ebp - 0x24], edi
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 4]
cmp edx, esi
jne 0x40338c
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x24]
or dword [ebp - 0x20], esi
cmp edx, esi
jne 0x40338c
sub ebx, eax
mov edi, ecx
lea esi, [eax - 0x7b]
or dword [ebp - 0x24], edx
cmp edi, 0xffffffb1
je 0x40338c
cmp ebx, eax
jne 0x40338c
or edi, esi
add dword [ebp - 0x24], edi
mov eax, dword [ebp - 0x24]
cmp eax, 0xf2bb
je 0x40338c
add dword [ebp - 0x24], ebx
and dword [ebp - 0x20], edi
mov edi, esi
mov ecx, dword [ebp - 0x20]
sub dword [ebp - 4], eax
test edi, 0x29
jne 0x40338c
lea edx, [ebx + 0x56]
or dword [ebp - 0x24], ecx
mov ebx, edi
cmp ecx, 0xffffffea
je 0x40338c
sub dword [ebp - 0x24], ebx
mov esi, eax
and esi, ecx
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x28], edi
cmp esi, 4
jne 0x40338c
add dword [ebp - 0x20], edx
sub dword [ebp - 0x24], esi
mov dword [ebp - 0xc], 0x40519d
and dword [ebp - 0x28], ebx
mov edi, dword [ebp - 0x10]
cmp edi, dword [ebp - 0x24]
jne 0x4033a3
add eax, edi
add dword [ebp - 4], eax
mov ecx, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x20]
xor dword [ebp - 0x24], edx
mov dword [ebp - 0x14], ebx
dec ecx
sub dword [ebp - 0x20], edx
sub dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0xc]
sub esi, eax
lea ecx, [ebx + 0xebc2]
cmp esi, dword [ebp - 0x18]
je 0x403430
mov ebx, dword [0x405139]
sub dword [ebp - 0x28], ecx
cmp esi, 0x8907
je 0x403430
and esi, eax
mov ecx, dword [0x405121]
cmp eax, dword [0x405139]
jne 0x403430
cmp eax, 0xffffffd9
jne 0x403430
mov ecx, dword [ebp - 4]
cmp edx, dword [0x405139]
jne 0x403430
mov ebx, ecx
mov ecx, dword [ebp - 4]
cmp edx, ebx
jne 0x403430
cmp edx, 0xffffffda
jne 0x403430
cmp ecx, 0xac09
jne 0x403430
test eax, 0x1e2f
je 0x403430
sub dword [ebp - 0x28], edx
cmp esi, ecx
jne 0x403430
cmp ebx, edi
je 0x403430
cmp ecx, dword [0x405139]
je 0x403430
xor dword [ebp - 4], ebx
sub dword [ebp - 0x28], ecx
add dword [ebp - 4], esi
mov esi, dword [edx]
sub dword [ebp - 0x18], ebx
mov ecx, dword [edx + 4]
sub dword [ebp - 0x14], ebx
or esi, esi
je 0x40350b
mov ebx, edx
add ebx, eax
sub dword [ebp - 0x28], ebx
repne movsb byte es:[edi], byte [esi]
test edi, 0
je 0x4034ab
lea ebx, [ecx + 0x2d61]
mov ecx, dword [ebp - 0x28]
add dword [ebp - 0x24], ecx
and dword [ebp - 0x14], edi
cmp esi, dword [ebp - 0x24]
jne 0x4034ab
test ebx, 0x21
je 0x4034ab
cmp esi, ebx
jne 0x4034ab
cmp ecx, eax
jne 0x4034ab
sub dword [ebp - 0x28], esi
mov ecx, 0x4b5e
or dword [ebp - 0x20], ebx
and ecx, esi
test edx, 0x4f
je 0x4034ab
lea ebx, [eax - 0x5b]
cmp ebx, dword [0x405121]
je 0x4034ab
sub ebx, esi
cmp ebx, dword [0x405121]
jne 0x4034ab
sub dword [ebp - 4], eax
xor dword [ebp - 4], ebx
add dword [ebp - 0x14], ecx
add dword [ebp - 0xc], 8
lea ecx, [eax + ebx*4 + 0x2c26]
lea ebx, [edx + esi*4 + 0x64]
test ecx, 0x9f
jne 0x403506
and ecx, eax
add dword [ebp - 4], ebx
mov ebx, dword [ebp - 0x24]
test edx, 0xef
je 0x403506
test edi, 0xc59d
je 0x403506
sub dword [ebp - 0x14], ecx
xor ecx, ecx
add dword [ebp - 4], ecx
add ebx, esi
add dword [ebp - 0x28], edx
sub ebx, eax
cmp ebx, 0x4a45
jne 0x403506
cmp ebx, dword [ebp - 0x18]
jne 0x403506
xor ecx, ecx
sub dword [ebp - 4], ebx
mov ebx, dword [0x405129]
sub ecx, ebx
sub dword [ebp - 0x14], ecx
jmp 0x403399
mov eax, dword [0x405129]
add dword [ebp - 0x24], eax
dec ecx
xor dword [ebp - 0x14], ecx
xor ecx, ecx
xor dword [ebp - 0x20], eax
or ecx, eax
and ecx, eax
and dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 0x28]
lea ecx, [ecx - 0x21]
sub dword [ebp - 0x28], eax
or ecx, eax
and edi, ecx
cmp edi, dword [0x405129]
jne 0x403595
mov ecx, eax
xor esi, esi
sub edi, ecx
cmp edi, 0xffffffbe
je 0x403595
and edi, eax
mov ecx, dword [0x405121]
inc edi
mov esi, dword [ebp - 0x24]
test edi, 0xb
jne 0x403595
sub dword [ebp - 0x24], edi
sub dword [ebp - 0x18], esi
lea edi, [eax + edi + 7]
add dword [ebp - 0x28], ecx
mov dword [ebp - 0x1c], eax
mov ecx, 0xcc
cmp eax, 0xfffffffa
je 0x403595
mov edx, dword [0x405121]
mov esi, dword [0x405149]
xor dword [ebp - 4], ecx
sub dword [ebp - 0x1c], eax
cmp edi, dword [ebp - 0x18]
je 0x403592
add dword [ebp - 0x1c], edi
sub dword [ebp - 0x24], edx
add dword [ebp - 0x1c], esi
sub dword [ebp - 0x20], eax
pop edi
mov edx, esi
sub dword [ebp - 4], edi
add dword [ebp - 0x24], edi
mov esi, dword [0x405121]
add edx, eax
sub dword [ebp - 0x24], edx
sub dword [ebp - 0x1c], esi
pop esi
mov ecx, dword [ebp - 0x20]
xor ebx, ebx
cmp esi, dword [ebp - 0x14]
jne 0x4035d1
mov edx, dword [0x405121]
xor ebx, ebx
or dword [ebp - 0x18], esi
add dword [ebp - 4], ecx
sub ebx, edx
or ebx, edi
sub ebx, edi
mov dword [ebp - 8], ebx
pop ebx
mov ecx, esi
mov edx, ecx
sub dword [ebp - 0x14], edx
leave
ret