Function at 0x420e20
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [0x4ea35c]
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
test eax, eax
je 0x420e40
cmp dword [eax + 4], 0
jne 0x420f45
mov eax, dword [eax]
test eax, eax
jne 0x420e30
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x421011
lea edx, [eax + 0x20]
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov esi, 0x20
mov ecx, dword [eax + 4]
add esi, 0x20
mov dword [edx], ecx
mov dword [eax + 4], edx
add edx, 0x20
cmp esi, 0xfe0
jbe 0x420e72
mov ecx, dword [0x4ea35c]
mov dword [eax], ecx
mov dword [0x4ea35c], eax
mov ebp, dword [eax + 4]
mov ebx, dword [esp + 0x40]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ebp
mov ecx, dword [ebp]
inc dword [eax + 8]
mov dword [eax + 4], ecx
lea ecx, [esp + 0x18]
mov eax, dword [esp + 0x44]
mov dword [esp + 0x1c], eax
call fcn.004210b0
test eax, eax
je 0x42100a
push 0x28
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x42100a
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
and edi, 0xf
mov ecx, dword [esp + 0x30]
mov dword [esi], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 8], eax
mov eax, edx
and eax, 1
shl edi, 3
or edi, eax
mov dword [esi + 0x1c], ecx
mov eax, dword [esi + 0x14]
mov ecx, dword [esp + 0x38]
and eax, 0xffffff80
or edi, eax
mov dword [esi + 0x24], ecx
mov eax, dword [esp + 0x2c]
mov dword [esi + 0x18], eax
mov eax, dword [esp + 0x34]
mov dword [esi + 0x14], edi
mov dword [esi + 0x20], eax
test edx, edx
je 0x420f55
mov eax, dword [ebx - 5]
mov dword [esi + 0xc], eax
mov ax, word [ebx - 1]
mov word [esi + 0x10], ax
mov al, byte [ebx + 1]
mov byte [esi + 0x12], al
jmp 0x420f60
test eax, eax
jne 0x420e95
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
mov eax, dword [ebx]
mov dword [esi + 0xc], eax
mov al, byte [ebx + 4]
mov byte [esi + 0x10], al
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
shl edi, 0x1f
sar edi, 0x1f
test edi, edi
lea ebx, [eax - 5]
cmove ebx, eax
xor eax, eax
test edi, edi
push ecx
setne al
push 0x40
lea eax, [eax*2 + 5]
push eax
push ebx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x420fb2
mov ecx, ebp
call fcn.00420db0
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
mov eax, dword [esp + 0x1c]
sub eax, ebx
mov byte [ebx], 0xe9
sub eax, 5
mov dword [ebx + 1], eax
test edi, edi
je 0x420fce
mov eax, dword [esp + 0x18]
mov word [eax], 0xf9eb
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, dword [esp + 0x48]
test eax, eax
je 0x421000
mov ecx, dword [esp + 0x20]
mov dword [eax], ecx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
mov ecx, ebp
call fcn.00420db0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2c
ret