Function at 0x41d350
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
mov dword [ebp - 0x154], 0
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x14c], 0
push 0xfa0
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
jne 0x41d3ae
xor eax, eax
jmp 0x41d6e3
push 0x40
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x40]
push ecx
call fcn.0041df10
add esp, 0xc
push pe_nt_image_headers32
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x140]
push eax
call fcn.0041df10
add esp, 0xc
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0xf8]
mov dword [ebp - 0x150], eax
movzx ecx, word [ebp - 0x13a]
imul ecx, ecx, 0x28
push ecx
mov edx, dword [ebp - 0x150]
push edx
mov eax, dword [ebp - 0x14c]
push eax
call fcn.0041df10
add esp, 0xc
mov eax, dword [ebp - 0xec]
xor edx, edx
div dword [ebp - 0x108]
test edx, edx
jne 0x41d42f
mov ecx, dword [ebp - 0xec]
mov dword [ebp - 0x144], ecx
jmp 0x41d465
mov eax, dword [ebp - 0xec]
xor edx, edx
div dword [ebp - 0x108]
mov dword [ebp - 0x144], eax
mov edx, dword [ebp - 0x144]
add edx, 1
mov dword [ebp - 0x144], edx
mov eax, dword [ebp - 0x144]
imul eax, dword [ebp - 0x108]
mov dword [ebp - 0x144], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0x44]
add edx, dword [ebp - 0x144]
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x154], 0
jmp 0x41d492
mov eax, dword [ebp - 0x154]
add eax, 1
mov dword [ebp - 0x154], eax
movzx ecx, word [ebp - 0x13a]
cmp dword [ebp - 0x154], ecx
jae 0x41d6b7
mov dword [ebp - 0x144], 0
mov edx, dword [ebp - 0x154]
imul edx, edx, 0x28
mov eax, dword [ebp - 0x14c]
mov ecx, dword [eax + edx + 0x10]
mov dword [ebp - 0x148], ecx
mov edx, dword [ebp - 0x154]
imul edx, edx, 0x28
mov eax, dword [ebp - 0x14c]
mov ecx, dword [eax + edx + 0x24]
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x160], 0
mov edx, dword [ebp - 0x158]
and edx, 0x4000000
je 0x41d50a
mov eax, dword [ebp - 0x160]
or eax, 0x200
mov dword [ebp - 0x160], eax
mov ecx, dword [ebp - 0x158]
and ecx, 0x20000000
je 0x41d587
mov edx, dword [ebp - 0x158]
and edx, 0x40000000
je 0x41d555
mov eax, dword [ebp - 0x158]
and eax, 0x80000000
je 0x41d544
mov ecx, dword [ebp - 0x160]
or ecx, 0x40
mov dword [ebp - 0x160], ecx
jmp 0x41d553
mov edx, dword [ebp - 0x160]
or edx, 0x20
mov dword [ebp - 0x160], edx
jmp 0x41d585
mov eax, dword [ebp - 0x158]
and eax, 0x80000000
je 0x41d576
mov ecx, dword [ebp - 0x160]
or ecx, 0x80
mov dword [ebp - 0x160], ecx
jmp 0x41d585
mov edx, dword [ebp - 0x160]
or edx, 0x10
mov dword [ebp - 0x160], edx
jmp 0x41d5f2
mov eax, dword [ebp - 0x158]
and eax, 0x40000000
je 0x41d5c4
mov ecx, dword [ebp - 0x158]
and ecx, 0x80000000
je 0x41d5b3
mov edx, dword [ebp - 0x160]
or edx, 4
mov dword [ebp - 0x160], edx
jmp 0x41d5c2
mov eax, dword [ebp - 0x160]
or eax, 2
mov dword [ebp - 0x160], eax
jmp 0x41d5f2
mov ecx, dword [ebp - 0x158]
and ecx, 0x80000000
je 0x41d5e3
mov edx, dword [ebp - 0x160]
or edx, 8
mov dword [ebp - 0x160], edx
jmp 0x41d5f2
mov eax, dword [ebp - 0x160]
or eax, 1
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x15c], 0
lea ecx, [ebp - 0x15c]
push ecx
mov edx, dword [ebp - 0x160]
push edx
mov eax, dword [ebp - 0x148]
push eax
mov ecx, dword [ebp - 0x44]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x41d629
jmp 0x41d6cb
mov edx, dword [ebp - 0x154]
imul edx, edx, 0x28
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax + edx + 8]
xor edx, edx
div dword [ebp - 0x108]
test edx, edx
jne 0x41d663
mov ecx, dword [ebp - 0x154]
imul ecx, ecx, 0x28
mov edx, dword [ebp - 0x14c]
mov eax, dword [edx + ecx + 8]
mov dword [ebp - 0x144], eax
jmp 0x41d6a6
mov ecx, dword [ebp - 0x154]
imul ecx, ecx, 0x28
mov edx, dword [ebp - 0x14c]
mov eax, dword [edx + ecx + 8]
xor edx, edx
div dword [ebp - 0x108]
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x144]
add eax, 1
mov dword [ebp - 0x144], eax
mov ecx, dword [ebp - 0x144]
imul ecx, dword [ebp - 0x108]
mov dword [ebp - 0x144], ecx
mov edx, dword [ebp - 0x44]
add edx, dword [ebp - 0x144]
mov dword [ebp - 0x44], edx
jmp 0x41d483
mov eax, dword [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
jmp 0x41d6e3
cmp dword [ebp - 0x14c], 0
je 0x41d6e1
mov ecx, dword [ebp - 0x14c]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov esp, ebp
pop ebp
ret