Function at 0x41af00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4595a0
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0xdc
mov eax, dword [0x46c008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov dword [0x487698], eax
mov dword [ebp - 0x5c], 0
mov byte [ebp - 0x5f], 0
mov ecx, 1
test ecx, ecx
je 0x41affb
movzx edx, byte [ebp - 0x5f]
test edx, edx
je 0x41afe0
mov eax, dword [ebp - 0x5c]
add eax, 0xb
mov dword [ebp - 0x5c], eax
lea ecx, [ebp - 0xe4]
push ecx
push 0x40
mov edx, dword [ebp - 0x5c]
mov eax, dword [edx - 0x14]
push eax
mov ecx, dword [ebp - 0x5c]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x6c], 0
jmp 0x41af93
mov edx, dword [ebp - 0x6c]
add edx, 1
mov dword [ebp - 0x6c], edx
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x6c]
cmp ecx, dword [eax - 0x14]
jae 0x41afde
mov edx, dword [ebp - 0x5c]
push ebp
movsb byte es:[edi], byte [esi]
movzx eax, byte [edx - 0x15]
mov ecx, dword [ebp - 0x5c]
add ecx, dword [ebp - 0x6c]
movzx edx, byte [ecx - 4]
xor eax, edx
mov ecx, dword [ebp - 0x5c]
add ecx, dword [ebp - 0x6c]
movzx edx, byte [ecx - 2]
xor eax, edx
mov ecx, dword [ebp - 0x5c]
add ecx, dword [ebp - 0x6c]
movzx edx, byte [ecx - 3]
xor eax, edx
mov ecx, dword [ebp - 0x5c]
add ecx, dword [ebp - 0x6c]
movzx edx, byte [ecx]
xor edx, eax
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0x6c]
mov byte [eax], dl
jmp 0x41af8a
jmp 0x41affb
mov byte [ebp - 0x5f], 1
jmp 0x41afee
mov ch, 0xbb
add byte [eax], al
add al, ch
add byte [eax], al
add byte [eax], al
call 0x41aff3
pop dword [ebp - 0x5c]
jmp 0x41af45
push 0x16
push 0xaf217f9a
imul esp, dword [ecx + edi*8 - 0x15], 0x3e936209
out dx, eax
jnp 0x41b014
jl 0x41b05a
mov dword [ecx], 0x7a98f917
adc dword [ebx + 0x7bed673e], edx
int3
cwde
jp 0x41b028
xchg ebx, eax
in eax, dx
jnp 0x41afe9
jg 0x41af9f
push cs
enter 0xfffffffffffff907, 0xffffffffffffff89
imul eax, dword [eax], 0xffffff93
loop 0x41b0a6
loop 0x41b0a6
adc esi, dword [ecx + 0x5f]
fistp word [ecx]
xor ecx, edi
mov esi, 0x3e93375c
in al, dx
jnp 0x41b070
jg 0x41b0b6
div dword [ecx]
and cl, bh
scasd eax, dword es:[edi]
dec ebp
xchg ebx, eax
fnstcw word ds:[bx + di - 0x1a]
invalid
sbb dword [esi - 0x35bc87bc], 0x59f3d60c
or al, 0xd6
pop ecx
mov cl, 0xda
cdq
cmp ah, byte [edi - 0x36]
jge 0x41b060
jmp 0x13db2c5a
adc edx, ebp
invalid
jge 0x41b072
invalid
test byte [esi - 0xc], bl
fisttp word [edx - 0x36]
insb byte es:[edi], dx
call dword [esi + 0x4c]
cmc
push esp
sbb dword [eax + 0x58], ebx
loop 0x41b09d
out 0xb5, al
out 0x8b, al
dec ebp
movsb byte es:[edi], byte [esi]
mov ch, 0xe6
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ecx - 0x14]
sub edx, 1
mov dword [ebp - 0x64], edx
jmp 0x41b0d0
mov eax, dword [ebp - 0x64]
sub eax, 1
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jl 0x41b116
mov ecx, dword [ebp - 0x5c]
movzx edx, byte [ecx - 0x15]
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0x64]
movzx ecx, byte [eax - 4]
xor edx, ecx
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0x64]
movzx ecx, byte [eax - 2]
xor edx, ecx
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0x64]
movzx ecx, byte [eax - 3]
xor edx, ecx
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0x64]
movzx ecx, byte [eax]
xor ecx, edx
mov edx, dword [ebp - 0x5c]
add edx, dword [ebp - 0x64]
mov byte [edx], cl
jmp 0x41b0c7
mov eax, 1
test eax, eax
je 0x41b8e3
mov dword [0x48769c], 0
mov dword [0x4876a4], 0
mov dword [ebp - 0x58], 0
mov byte [ebp - 0x5e], 0
mov ecx, 1
test ecx, ecx
je 0x41b1f8
movzx edx, byte [ebp - 0x5e]
test edx, edx
je 0x41b1dd
mov eax, dword [ebp - 0x58]
add eax, 0xb
mov dword [ebp - 0x58], eax
lea ecx, [ebp - 0xec]
push ecx
push 0x40
mov edx, dword [ebp - 0x58]
mov eax, dword [edx - 0x14]
push eax
mov ecx, dword [ebp - 0x58]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x70], 0
jmp 0x41b190
mov edx, dword [ebp - 0x70]
add edx, 1
mov dword [ebp - 0x70], edx
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x70]
cmp ecx, dword [eax - 0x14]
jae 0x41b1db
mov edx, dword [ebp - 0x58]
movzx eax, byte [edx - 0x15]
mov ecx, dword [ebp - 0x58]
add ecx, dword [ebp - 0x70]
movzx edx, byte [ecx - 4]
xor eax, edx
mov ecx, dword [ebp - 0x58]
add ecx, dword [ebp - 0x70]
movzx edx, byte [ecx - 2]
xor eax, edx
mov ecx, dword [ebp - 0x58]
add ecx, dword [ebp - 0x70]
movzx edx, byte [ecx - 3]
xor eax, edx
mov ecx, dword [ebp - 0x58]
add ecx, dword [ebp - 0x70]
movzx edx, byte [ecx]
xor edx, eax
mov eax, dword [ebp - 0x58]
add eax, dword [ebp - 0x70]
mov byte [eax], dl
jmp 0x41b187
jmp 0x41b1f8
mov byte [ebp - 0x5e], 1
jmp 0x41b1eb
call 0x41b1f0
pop dword [ebp - 0x58]
jmp 0x41b142
cmp dword [0x17aacba0], 0x7c
mov esi, 0xf48859b9
pop ebx
salc
das
invalid
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041bad0
mov esp, ebp
pop ebp
ret