Function at 0x410bfe
Capabilities:
Allocate or change rwx memory
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x443d1c], eax
je 0x410c1f
mov eax, 0x10dd
jmp 0x410e3c
mov eax, dword [0x443d24]
test eax, eax
jne 0x410e3c
mov ecx, dword [0x443d98]
push ebx
push esi
test ecx, ecx
jne 0x410c46
push 6
pop edi
mov dword [0x443d24], edi
jmp 0x410df3
mov dword [ebp - 4], edi
mov ebx, edi
call fcn.00410836
mov esi, eax
mov ecx, 0x40bf52
mov dword [ebp - 0x10], esi
call fcn.00410836
mov dword [ebp - 0x1c], eax
cmp eax, esi
jne 0x410c77
cmp dword [0x443d08], ebx
jne 0x410df3
jmp 0x410dd1
push 0x18
call fcn.004171b3
mov ebx, eax
mov dword [ebp - 0x18], ebx
pop ecx
test ebx, ebx
jne 0x410c90
push 8
pop edi
jmp 0x410dd1
mov ecx, esi
call fcn.004105cb
mov dword [ebp - 4], eax
test eax, eax
je 0x410c88
mov ebx, edi
mov edx, esi
mov dword [ebp - 8], ebx
lea ecx, [ebp - 0xc]
mov dword [ebp - 8], edx
push ecx
push ecx
lea ecx, [ebx + eax]
mov dword [ebp - 0xc], edi
call fcn.00411b81
mov edx, eax
cmp dword [ebp - 0xc], edi
jne 0x410d12
mov ecx, dword [ebp - 8]
mov ebx, edx
sub ebx, esi
mov al, byte [ecx]
cmp al, 0xe9
je 0x410d12
cmp al, 0xe0
je 0x410d12
cmp al, 0xc2
je 0x410d12
cmp al, 0xc3
je 0x410d12
cmp al, 0xcc
je 0x410d12
cmp al, 0xff
jne 0x410ce6
cmp byte [ecx + 1], 0x25
je 0x410d12
cmp al, 0x26
je 0x410cfe
cmp al, 0x2e
je 0x410cfe
cmp al, 0x36
je 0x410cfe
cmp al, 0xe3
je 0x410cfe
cmp al, 0x64
je 0x410cfe
cmp al, 0x65
jne 0x410d0a
cmp byte [ecx + 1], 0xff
jne 0x410d0a
cmp byte [ecx + 2], 0x25
je 0x410d12
mov eax, dword [ebp - 4]
cmp ebx, 5
jl 0x410ca5
mov dword [ebp - 8], ebx
cmp ebx, 5
mov ebx, dword [ebp - 0x18]
jge 0x410d32
cmp dword [0x443d08], 0
push 9
pop edi
jne 0x410dd7
jmp 0x410dd1
mov eax, dword [ebp - 8]
cmp eax, 0x12
jbe 0x410d41
push 6
jmp 0x410c8a
mov ecx, dword [ebp - 4]
lea edx, [eax + esi]
mov esi, dword [ebp - 0x1c]
mov dword [ecx + 0x18], edx
mov dword [ecx + 0x1c], esi
lea esi, [ecx + 0x17]
add ecx, eax
mov byte [esi], al
lea eax, [ecx + 5]
mov byte [ecx], 0xe9
sub edx, eax
mov eax, edi
and dword [ebp - 0x1c], eax
mov dword [ecx + 1], edx
add ecx, 5
mov edx, esi
sub edx, ecx
cmp ecx, esi
cmova edx, dword [ebp - 0x1c]
test edx, edx
je 0x410d81
mov byte [ecx], 0xcc
inc ecx
inc eax
cmp eax, edx
jb 0x410d78
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
push 0x40
push dword [ebp - 8]
mov dword [ebp - 0x14], edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x410dc9
mov ecx, esi
call fcn.004107d5
mov esi, eax
test esi, esi
je 0x410e0f
mov eax, 0x6544
cmp word [esi + 0x1c], ax
je 0x410e0f
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], edi
push eax
push 0x40
push 0x40
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x410e01
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [0x443d24], edi
mov eax, dword [ebp - 4]
test eax, eax
je 0x410de5
mov ecx, eax
call fcn.004107b4
test ebx, ebx
je 0x410df3
push 0x18
push ebx
call fcn.004171e6
pop ecx
pop ecx
mov dword [0x443d18], 0x443d98
mov eax, edi
jmp 0x410e3a
mov dword [esi + 0x1c], 0x6f746544
mov dword [esi + 0x20], 0x21737275
mov eax, dword [ebp - 4]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0xc], eax
mov dword [ebx + 4], edi
mov dword [ebx + 8], 0x443d98
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [0x443d0c]
mov dword [ebx], eax
xor eax, eax
mov dword [0x443d0c], ebx
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc