Function at 0x4010ce
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edx
push eax
sub ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
push ebx
push esi
push esi
xor edi, edi
dec edi
mov dword [ebp - 0xc], edi
jmp 0x401025
pop edi
xor eax, eax
or eax, dword [ebp - 8]
clc
sbb eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
cmp esi, dword [ebp + 0x10]
jae 0x4010c8
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 8]
mov ebx, ecx
mov ecx, dword [ebp - 0xc]
sub edx, edx
sbb edx, dword [ebx]
neg edx
not ecx
not edx
mov dword [ebp - 0x14], edx
or ecx, dword [ebp - 0x14]
not ecx
and ecx, 0xff
mov ebx, dword [ebp + 0x14]
add ebx, dword [ebp - 4]
mov edx, dword [ebx]
mov ebx, edx
mov dword [ebp - 0x14], IUnknown_QueryInterface_Proxy
and ebx, dword [ebp - 0x14]
mov dword [ebp - 0x14], 0xffffffff
xor ebx, dword [ebp - 0x14]
add ebx, 1
adc ecx, ebx
and edx, 0
and ebx, edx
xor ebx, dword [ebp + 8]
add ebx, dword [ebp - 8]
and dword [ebp - 0x10], edx
mov edx, ebx
or dword [ebp - 0x10], ebx
mov ebx, dword [ebx]
mov bl, cl
mov ecx, edx
xor edx, edx
push edx
pop dword [ecx]
neg ebx
call fcn.0040128e
adc dword [ecx], ebx
xor ebx, ebx
or ebx, dword [ebp - 0x14]
mov edx, dword [ecx]
xor edx, ebx
inc edx
mov dword [ecx], edx
mov edi, dword [ebp - 4]
inc edi
mov dword [ebp - 4], edi
cmp dword [ebp - 4], 1
jne 0x4010bb
and dword [ebp - 4], 0
cmp dword [ebp - 4], 0xb200000
jne 0x4011eb
mov esp, ebp
pop ebp
ret 0x10
push ebp
mov ebp, esp
sub esp, 0x1f8
xchg esi, edi
push esi
push edi
push ebx
push ebp
inc ecx
lea edi, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push ecx
push 0xa
push edi
push 0xa
call dword [sym.imp.NTDLL.dll__itoa]
add esp, 0xc
mov edi, dword [ebp - 0x10]
sub edi, 0x3031
jne section..text
pop ecx
loop 0x4010de
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.NTDLL.dll_NtAdjustPrivilegesToken]
cmp eax, 0xc000000d
jne entry0
mov esi, eax
sub esi, 0xc000000d
mov dword [ebp - 0x18], esi
and dword [ebp - 4], esi
clc
xor edx, edx
mov ebx, edx
or ebx, 0x449ec6
not ebx
inc ebx
sub esi, ebx
add esi, dword [ebp - 0x18]
mov dword [ebp - 0xc], esi
mov eax, ebp
mov esi, 0x1a8
neg esi
add eax, esi
mov dword [ebp - 0x10], eax
xor esi, esi
sub esi, section..data
neg esi
mov dword [ebp - 0x28], 0
xor dword [ebp - 0x28], esi
mov ecx, dword [ebp - 0x10]
mov edi, 0xfffffff0
sub ecx, edi
mov dword [ebp - 0x1c], ecx
sub dword [ebp - 4], 0x30
xor ecx, ecx
dec ecx
not dword [ebp - 4]
sub dword [ebp - 4], ecx
push dword [ebp - 0x28]
push dword [ebp - 4]
push dword [ebp - 0xc]
lea ebx, [ebp - 0x1a8]
push ebx
call fcn.0040124b
xor eax, eax
or eax, dword [ebp - 0x10]
add eax, 4
mov eax, dword [eax]
mov ebx, dword [ebp - 0x10]
add eax, dword [ebx]
mov dword [ebp - 0x24], eax
mov eax, 0x40
push eax
and dword [ebp - 0x18], 0
mov ecx, 0x3000
push ecx
lea ecx, [ebp - 0x24]
push ecx
push 0
xor ecx, ecx
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x20]
push ecx
push 0xffffffffffffffff
call dword [sym.imp.NTDLL.dll_NtAllocateVirtualMemory]
mov eax, dword [ebp - 0x20]
test eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], 0x400000
and dword [ebp - 0x1ac], 0
jmp 0x401207
push ecx
jmp 0x401018
mov edi, dword [ebp - 0x1ac]
inc edi
mov dword [ebp - 0x1ac], edi
mov ecx, dword [ebp - 0x1c]
add ecx, 8
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x1ac]
mov edi, dword [ecx + 8]
cmp esi, edi
jae 0x401259
push dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
push dword [edx + 4]
mov eax, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x20]
add ebx, dword [eax]
push ebx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x18]
push edx
call fcn.00401243
mov edx, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
add ebx, dword [edx + 4]
mov dword [ebp - 0x18], ebx
jmp 0x4011f1
mov ecx, dword [ebp - 0x20]
push ecx
mov eax, dword [ebp - 8]
mov ebx, 0x1530
add eax, ebx
mov dword [ebp - 0x14], eax
push dword [ebp - 0x19c]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
add ecx, dword [edx + 4]
push ecx
xor ecx, ecx
or ecx, dword [ebp - 0x14]
push ecx
add ecx, 0x1c00000
push ecx
mov esi, dword [ebp - 0x14]
push esi
ret 4