Function at 0x41ad4c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd88
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
mov dword [ebp - 4], eax
push esi
push 0x301
call fcn.0040af30
mov ebx, eax
test ebx, ebx
je 0x41afb9
mov eax, 0x41afd0
call fcn.0041ac10
mov edi, eax
test edi, edi
je 0x41afb9
mov word [ebp - 0x275], 0xb848
xor ecx, ecx
mov edx, 0x41afe4
mov eax, edi
call fcn.00406ce4
xor edx, edx
mov dword [ebp - 0x273], eax
mov dword [ebp - 0x26f], edx
mov byte [ebp - 0x26b], 0x50
mov byte [ebp - 0x26a], 0x51
mov byte [ebp - 0x269], 0x52
mov word [ebp - 0x268], 0x5041
mov word [ebp - 0x266], 0x5141
mov dword [ebp - 0x264], 0x28ec8348
mov word [ebp - 0x260], 0xb948
mov eax, ebx
xor edx, edx
mov dword [ebp - 0x25e], eax
mov dword [ebp - 0x25a], edx
mov word [ebp - 0x256], 0xba48
lea eax, [ebx + 0x260]
xor edx, edx
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x250], edx
mov word [ebp - 0x24c], 0xe2ff
mov eax, dword [ebp - 0x273]
mov dword [ebp - 0x24a], eax
mov eax, dword [ebp - 0x26f]
mov dword [ebp - 0x246], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 8]
mov eax, dword [eax - 0x14]
push eax
call sub.KERNEL32.dll_lstrlenW
add eax, eax
mov word [ebp - 0x23d], ax
mov ax, word [ebp - 0x23d]
add ax, 2
mov word [ebp - 0x23b], ax
xor eax, eax
mov dword [ebp - 0x239], eax
lea eax, [ebx + 0x48]
xor edx, edx
mov dword [ebp - 0x235], eax
mov dword [ebp - 0x231], edx
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 8]
mov eax, dword [eax - 0x14]
push eax
lea eax, [ebp - 0x22d]
push eax
call sub.KERNEL32.dll_lstrcpyW
xor ecx, ecx
mov edx, 0x41aff8
mov eax, edi
call fcn.00406ce4
xor edx, edx
mov dword [ebp - 0x25], eax
mov dword [ebp - 0x21], edx
xor ecx, ecx
mov edx, 0x41b018
mov eax, edi
call fcn.00406ce4
xor edx, edx
mov dword [ebp - 0x1d], eax
mov dword [ebp - 0x19], edx
lea eax, [ebp - 0x10]
push eax
push 0x261
lea eax, [ebp - 0x275]
push eax
push ebx
push esi
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
je 0x41afb9
cmp dword [ebp - 0x10], 0x261
jne 0x41afb9
lea eax, [ebp - 0x10]
push eax
push 0xa0
push 0x4d4328
lea eax, [ebx + 0x260]
push eax
push esi
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
je 0x41afb9
cmp dword [ebp - 0x10], 0xa0
jne 0x41afb9
lea eax, [ebp - 0x10]
push eax
push 5
lea eax, [ebp - 9]
push eax
mov eax, dword [ebp - 0x24a]
push eax
push esi
call sub.KERNEL32.dll_ReadProcessMemory
test eax, eax
je 0x41afb9
cmp dword [ebp - 0x10], 5
jne 0x41afb9
lea eax, [ebp - 0x10]
push eax
push 5
lea eax, [ebp - 9]
push eax
lea eax, [ebx + 0x33]
push eax
push esi
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
je 0x41afb9
cmp dword [ebp - 0x10], 5
jne 0x41afb9
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
mov eax, dword [ebp - 0x24a]
push eax
push esi
call sub.KERNEL32.dll_VirtualProtectEx
test eax, eax
je 0x41afb9
mov byte [ebp - 9], 0xe9
mov eax, dword [ebp - 0x24a]
sub ebx, eax
sub ebx, 5
mov dword [ebp - 8], ebx
lea eax, [ebp - 0x10]
push eax
push 5
lea eax, [ebp - 9]
push eax
mov eax, dword [ebp - 0x24a]
push eax
push esi
call sub.KERNEL32.dll_WriteProcessMemory
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 5
mov eax, dword [ebp - 0x24a]
push eax
push esi
call sub.KERNEL32.dll_VirtualProtectEx
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8