Function at 0x40d100
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x3c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x18]
add ecx, dword [eax + 0x11]
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
add eax, dword [ecx + 0x15]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 5]
mov dword [esp + 4], eax
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub esp, 0x10
mov dword [ebp - 0x28], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x34], 0xf6d9c309
mov edi, dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
jmp 0x40d190
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x34], 0x9717ac00
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x34]
cmp eax, 0x95d93c05
jg 0x40d1b0
cmp eax, 0x940a1af0
jne 0x40d190
jmp 0x40d179
cmp eax, 0x9717abff
jg 0x40d1e0
cmp eax, 0x95d93c06
jne 0x40d190
mov eax, 0x56e4a5bd
cmp dword [ebp - 0x28], 0
jne 0x40d1ce
mov eax, 0x224ce397
mov dword [ebp - 0x34], eax
jmp 0x40d190
cmp eax, 0xa1818453
jg 0x40d1fe
cmp eax, 0x9717ac00
jne 0x40d190
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x34], 0x50154147
jmp 0x40d190
cmp eax, 0xa4b5bf5b
jg 0x40d218
cmp eax, 0xa1818454
jne 0x40d190
mov dword [ebp - 0x34], 0x59628186
jmp 0x40d190
cmp eax, 0xaf338b8d
jg 0x40d236
cmp eax, 0xa4b5bf5c
jne 0x40d190
mov dword [ebp - 0x34], 0x95d93c06
jmp 0x40d190
cmp eax, 0xb0567260
jg 0x40d254
cmp eax, 0xaf338b8e
jne 0x40d190
mov dword [ebp - 0x34], 0xfbb84173
jmp 0x40d190
cmp eax, 0x7d5b29ae
jg 0x40d2ab
cmp eax, 0x7c3fafe5
jg 0x40d2d9
cmp eax, 0x7b36a6e3
jg 0x40d2f0
cmp eax, 0x7a13edbb
jg 0x40d307
cmp eax, 0x792a5cd8
jg 0x40d324
cmp eax, 0xb136cc26
jg 0x40d367
cmp eax, 0xb0567261
jne 0x40d190
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x34], 0xc80edc92
jmp 0x40d190
cmp eax, 0x7d5b29af
jne 0x40d190
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx + 1]
add ecx, eax
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.0040bef0
mov dword [ebp - 0x34], 0x3a6b2575
jmp 0x40d190
cmp eax, 0x7c3fafe6
jne 0x40d190
mov dword [ebp - 0x34], 0xb0567261
jmp 0x40d190
cmp eax, 0x7b36a6e4
jne 0x40d190
mov dword [ebp - 0x34], 0xbd17b0bc
jmp 0x40d190
cmp eax, 0x7a13edbc
jne 0x40d190
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x34], 0xb0567261
jmp 0x40d190
cmp eax, 0x792a5cd9
jne 0x40d190
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 5]
mov edx, dword [ebp - 0x28]
add edx, dword [eax + 1]
add eax, 0xd
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.004028f0
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 5]
lea eax, [eax + ecx + 0xd]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], 0xb136cc27
jmp 0x40d190
cmp eax, 0xbd17b0bb
jg 0x40d388
cmp eax, 0xb136cc27
jne 0x40d190
inc dword [ebp - 0x2c]
mov dword [ebp - 0x34], 0x1bb006d8
jmp 0x40d190
cmp eax, 0xbdffb015
jg 0x40d3a8
cmp eax, 0xbd17b0bc
jne 0x40d190
mov esi, dword [edi]
mov dword [ebp - 0x34], 0xcded3656
jmp 0x40d190
cmp eax, 0xc80edc91
jg 0x40d3bf
cmp eax, 0xbdffb016
jne 0x40d190
jmp 0x40d6bb
cmp eax, 0xcded3655
jg 0x40d3dd
cmp eax, 0xc80edc92
jne 0x40d190
mov dword [ebp - 0x34], 0xbdffb016
jmp 0x40d190
cmp eax, 0xd127ec23
jg 0x40d3fb
cmp eax, 0xcded3656
jne 0x40d190
mov dword [ebp - 0x34], 0x95d93c06
jmp 0x40d190
cmp eax, 0xde40dcac
jg 0x40d419
cmp eax, 0xd127ec24
jne 0x40d190
mov dword [ebp - 0x34], 0x1bb006d8
jmp 0x40d190
cmp eax, 0xe582baf0
jg 0x40d43e
cmp eax, 0xde40dcad
jne 0x40d190
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x34], 0xd127ec24
jmp 0x40d190
cmp eax, 0xf6d9c308
jg 0x40d45e
cmp eax, 0xe582baf1
jne 0x40d190
mov esi, dword [edi]
mov dword [ebp - 0x34], 0xbd17b0bc
jmp 0x40d190
cmp eax, 0xfbb84172
jg 0x40d488
cmp eax, 0xf6d9c309
jne 0x40d190
mov eax, 0x26d184e8
cmp dword [ebp - 0xc], 0
jne 0x40d480
mov eax, 0x7b36a6e4
mov dword [ebp - 0x34], eax
jmp 0x40d190
cmp eax, 0x1bb006d7
jg 0x40d4cf
cmp eax, 0xfbb84173
jne 0x40d190
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
add eax, dword [ecx + 0x11]
mov ecx, dword [ecx + 0xd]
mov edx, dword [ebp - 0x28]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call fcn.0040cc00
test eax, eax
mov eax, 0xa4b5bf5c
js 0x40d4c7
mov eax, 0x7c3fafe6
mov dword [ebp - 0x34], eax
jmp 0x40d190
cmp eax, 0x224ce396
jg 0x40d4fe
cmp eax, 0x1bb006d8
jne 0x40d190
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
mov eax, 0x792a5cd9
cmp ecx, dword [edx + 0xd]
jb 0x40d4f6
mov eax, 0x421a12ea
mov dword [ebp - 0x34], eax
jmp 0x40d190
cmp eax, 0x26d184e7
jg 0x40d51c
cmp eax, 0x224ce397
jne 0x40d190
mov dword [ebp - 0x34], 0x9717ac00
jmp 0x40d190
cmp eax, 0x3a6b2574
jg 0x40d53a
cmp eax, 0x26d184e8
jne 0x40d190
mov dword [ebp - 0x34], 0xde40dcad
jmp 0x40d190
cmp eax, 0x421a12e9
jg 0x40d573
cmp eax, 0x3a6b2575
jne 0x40d190
call fcn.0040e010
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
not eax
or eax, 0xfffffffc
cmp eax, 0xffffffff
mov eax, 0xa1818454
jne 0x40d56b
mov eax, 0xfbb84173
mov dword [ebp - 0x34], eax
jmp 0x40d190
cmp eax, 0x50154146
jg 0x40d5c2
cmp eax, 0x421a12ea
jne 0x40d190
mov eax, dword [ebp - 0x24]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 8], 0x20
call fcn.004028f0
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
not eax
or eax, 0xfffffffe
cmp eax, 0xffffffff
mov eax, 0x7d5b29af
jne 0x40d5ba
mov eax, 0x3a6b2575
mov dword [ebp - 0x34], eax
jmp 0x40d190
cmp eax, 0x53eabeb7
jg 0x40d5e0
cmp eax, 0x50154147
jne 0x40d190
mov dword [ebp - 0x34], 0xbdffb016
jmp 0x40d190
cmp eax, 0x56e4a5bc
jg 0x40d631
cmp eax, 0x53eabeb8
jne 0x40d190
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
mov edx, 0xd88a9346
sub edx, dword [ecx + 1]
lea eax, [edx + eax + 0x27756cba]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov edx, dword [edx + 0x19]
add edx, ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.0040c690
mov dword [ebp - 0x34], 0x59628186
jmp 0x40d190
cmp eax, 0x56e4a5bd
je 0x40d672
cmp eax, 0x59628186
jne 0x40d69d
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
sub eax, dword [ecx + 1]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov edx, dword [edx + 0x19]
add edx, ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.0040c690
mov dword [ebp - 0x34], 0xaf338b8e
jmp 0x40d190
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_VirtualFree]
sub esp, 0xc
mov dword [ebp - 0x34], 0x224ce397
jmp 0x40d190
cmp eax, 0x599566ee
jne 0x40d190
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x34], 0xde40dcad
jmp 0x40d190
mov eax, dword [ebp - 0x10]
add esp, 0x3c
pop esi
pop edi
pop ebp
ret