Function at 0x4f50ec
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x70
mov ebx, ecx
mov al, byte [ebp + 8]
mov ecx, dword [0x5a8564]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
test al, al
je 0x4f513c
xor edi, edi
inc edi
mov esi, 0x5787c6
mov ecx, ebx
push 0
push 0x50b700
push edi
push str.NtMapViewOfSection
push esi
call fcn.004f4b96
mov ecx, ebx
push edi
push 0x50b940
push edi
push str.NtUnmapViewOfSection
push esi
call fcn.004f4b96
jmp 0x4f5146
cmp dword [ebx + 0xc], 0
je 0x4f52f8
cmp dword [ebx], 0
lea esi, [ebp - 0x60]
jne 0x4f5174
push str.inner_
push 0xc7
push str....._base_allocatorpartition_allocatorpointers_raw_ref.h
push esi
call fcn.00460aa0
add esp, 0x10
mov ecx, esi
call fcn.00458ca0
mov ecx, esi
call fcn.00460b10
mov eax, dword [ebx]
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
sub esp, 0x14
movdqa xmm0, xmmword [0x578730]
movdqu xmmword [esp + 4], xmm0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, ebx
mov ebx, eax
mov dword [ebp - 0x7c], ecx
mov esi, dword [ecx + 0xc]
shl esi, 6
lea eax, [esi + 0x50]
mov dword [ebp - 0x78], eax
push eax
call fcn.004f4980
add esp, 4
mov edi, eax
mov ecx, 0xfffff000
and eax, ecx
add eax, ebx
and edi, 0xfff
add esi, 0x104f
and esi, ecx
push 0x40
push 0x1000
push esi
push eax
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, eax
test eax, eax
je 0x4f5310
add ebx, edi
pcmpeqd xmm0, xmm0
movdqu xmmword [ebp - 0x58], xmm0
xor eax, eax
dec eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
movdqu xmmword [ebp - 0x28], xmm0
movdqu xmmword [ebp - 0x38], xmm0
movdqu xmmword [ebp - 0x48], xmm0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x5c], 0x10
pxor xmm0, xmm0
movdqu xmmword [0x5ba1f8], xmm0
movdqu xmmword [0x5ba208], xmm0
movdqu xmmword [0x5ba218], xmm0
movdqu xmmword [0x5ba228], xmm0
movdqu xmmword [0x5ba238], xmm0
movdqu xmmword [0x5ba248], xmm0
movdqu xmmword [0x5ba254], xmm0
mov ecx, dword [ebp - 0x7c]
lea esi, [ebp - 0x60]
push esi
push eax
push ebx
call fcn.004f5648
mov edi, eax
test eax, eax
jne 0x4f52fa
lea eax, [ebp - 0x6c]
mov dword [eax], 0xffffffff
push eax
push 0x10
push esi
push ebx
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, 0x2a
test eax, eax
je 0x4f52fa
cmp dword [ebp - 0x6c], 0x10
jne 0x4f52fa
lea eax, [ebp - 0x70]
mov dword [eax], 0xffffffff
push eax
push 0x20
push dword [ebp - 0x78]
push ebx
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov esi, dword [ebp - 0x7c]
cmp dword [esi], 0
jne 0x4f52e1
lea edi, [ebp - 0x64]
push str.inner_
push 0xc7
push str....._base_allocatorpartition_allocatorpointers_raw_ref.h
push edi
call fcn.00460aa0
add esp, 0x10
mov ecx, edi
call fcn.00458ca0
mov ecx, edi
call fcn.00460b10
mov ecx, dword [esi]
push 0x6c
push 0x5ba1f8
push str.g_originals
call fcn.004d9100
mov edi, eax
jmp 0x4f52fa
xor edi, edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005327f1
mov eax, edi
add esp, 0x70
pop esi
pop edi
pop ebx
pop ebp
ret 4
push 0x182
push str....._sandboxwin_srcinterception.cc
push str.PatchNtdll
lea esi, [ebp - 0x60]
push esi
call fcn.00451690
add esp, 0x10
lea eax, [ebp - 0x68]
push esi
push str.thunk_base
push eax
mov esi, eax
call fcn.00458b50
add esp, 0xc
mov ecx, esi
call fcn.00458cb0
jmp 0x4f51e6