Function at 0x1001b5f8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, eax
xor edi, edi
push esi
push 0x3e3
call fcn.1000bfa4
mov ebx, eax
test ebx, ebx
je 0x1001b89f
cmp dword [0x100b68c0], 0
jne 0x1001b63a
mov dl, 1
mov eax, dword [0x100b5c4c]
call fcn.1000ab3c
mov dword [0x100b68c0], eax
cmp dword [0x100b68c4], 0
jne 0x1001b654
mov dl, 1
mov eax, dword [0x100b5c74]
call fcn.1000ab3c
mov dword [0x100b68c4], eax
cmp dword [0x100b68c8], 0
jne 0x1001b66e
mov dl, 1
mov eax, dword [0x100b5c6c]
call fcn.1000ab3c
mov dword [0x100b68c8], eax
cmp dword [0x100b68cc], 0
jne 0x1001b688
mov dl, 1
mov eax, dword [0x100b5c70]
call fcn.1000ab3c
mov dword [0x100b68cc], eax
cmp dword [0x100b68d0], 0
jne 0x1001b6a4
mov eax, dword [0x100b6d90]
mov eax, dword [eax]
mov dl, 1
call fcn.1000ab3c
mov dword [0x100b68d0], eax
cmp dword [0x100b68d4], 0
jne 0x1001b6be
mov dl, 1
mov eax, dword [0x100b5c78]
call fcn.1000ab3c
mov dword [0x100b68d4], eax
mov byte [ebp - 0x25a], 0xb8
mov dword [ebp - 0x259], ebx
mov byte [ebp - 0x255], 0xb9
lea eax, [ebx + 0x245]
mov dword [ebp - 0x254], eax
mov word [ebp - 0x250], 0xd1ff
xor eax, eax
mov dword [ebp - 0x24e], eax
xor eax, eax
mov dword [ebp - 0x24a], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.1001b5bc
mov dword [ebp - 0x246], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 8]
mov eax, dword [eax - 0x10]
push eax
call sub.KERNEL32.dll_lstrlenW
add eax, eax
mov word [ebp - 0x23d], ax
mov ax, word [ebp - 0x23d]
add ax, 2
mov word [ebp - 0x23b], ax
lea eax, [ebx + 0x25]
mov dword [ebp - 0x239], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 8]
mov eax, dword [eax - 0x10]
push eax
lea eax, [ebp - 0x235]
push eax
call sub.KERNEL32.dll_lstrcpyW
mov eax, dword [0x100b68c4]
mov dword [ebp - 0x2d], eax
mov eax, dword [0x100b68c0]
mov dword [ebp - 0x29], eax
mov eax, dword [0x100b68c8]
mov dword [ebp - 0x25], eax
mov eax, dword [0x100b68cc]
mov dword [ebp - 0x21], eax
mov eax, dword [0x100b68d0]
mov dword [ebp - 0x1d], eax
mov eax, dword [0x100b68d4]
mov dword [ebp - 0x19], eax
cmp dword [ebp - 0x246], 0
je 0x1001b88d
lea eax, [ebp - 0x10]
push eax
push 0x246
lea eax, [ebp - 0x25a]
push eax
push ebx
push esi
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
je 0x1001b88d
cmp dword [ebp - 0x10], 0x246
jne 0x1001b88d
lea eax, [ebp - 0x10]
push eax
push 0x19d
push 0x100b68dc
lea eax, [ebx + 0x245]
push eax
push esi
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
je 0x1001b88d
cmp dword [ebp - 0x10], 0x19d
jne 0x1001b88d
lea eax, [ebp - 0x10]
push eax
push 5
lea eax, [ebp - 9]
push eax
mov eax, dword [ebp - 0x246]
push eax
push esi
call sub.KERNEL32.dll_ReadProcessMemory
test eax, eax
je 0x1001b88d
cmp dword [ebp - 0x10], 5
jne 0x1001b88d
lea eax, [ebp - 0x10]
push eax
push 5
lea eax, [ebp - 9]
push eax
lea eax, [ebx + 0x18]
push eax
push esi
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
je 0x1001b88d
cmp dword [ebp - 0x10], 5
jne 0x1001b88d
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
mov eax, dword [ebp - 0x246]
push eax
push esi
call sub.KERNEL32.dll_VirtualProtectEx
test eax, eax
je 0x1001b88d
mov byte [ebp - 9], 0xe9
mov eax, ebx
sub eax, dword [ebp - 0x246]
sub eax, 5
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
push 5
lea eax, [ebp - 9]
push eax
mov eax, dword [ebp - 0x246]
push eax
push esi
call sub.KERNEL32.dll_WriteProcessMemory
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 5
mov eax, dword [ebp - 0x246]
push eax
push esi
call sub.KERNEL32.dll_VirtualProtectEx
mov edi, 1
lea eax, [ebp - 0x14]
push eax
push 0x20
push 0x3e3
push ebx
push esi
call sub.KERNEL32.dll_VirtualProtectEx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8