Function at 0x40b4e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x40
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x11]
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
add eax, dword [ecx + 0x15]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 5]
mov dword [esp + 4], eax
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub esp, 0x10
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x38], 0xef465ab9
mov edi, dword [sym.imp.ADVAPI32.dll_AddAccessAllowedAceEx]
jmp 0x40b590
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
sub eax, dword [ecx + 1]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
mov edx, dword [edx + 0x19]
add edx, ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.0040a880
mov dword [ebp - 0x38], 0xfe502bb
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x38]
cmp eax, 0x7ad15046
jg 0x40b5c0
cmp eax, 0x8bf0ad70
jg 0x40b5d0
cmp eax, 0x824df079
jne 0x40b590
mov dword [ebp - 0x38], 0xddea7bc9
jmp 0x40b590
cmp eax, 0x7ad15047
jne 0x40b590
jmp 0x40b559
cmp eax, 0xa1f0bd5a
jg 0x40b5ed
cmp eax, 0x8bf0ad71
jne 0x40b590
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x38], 0xa1f0bd5b
jmp 0x40b590
cmp eax, 0xbdd2369b
jg 0x40b600
cmp eax, 0xa1f0bd5b
jne 0x40b590
jmp 0x40b968
cmp eax, 0xcded9543
jg 0x40b61d
cmp eax, 0xbdd2369c
jne 0x40b590
inc dword [ebp - 0x30]
mov dword [ebp - 0x38], 0x2a3f56fb
jmp 0x40b590
cmp eax, 0xdd4961c4
jg 0x40b63d
cmp eax, 0xcded9544
jne 0x40b590
mov esi, dword [edi]
mov dword [ebp - 0x38], 0xddea7bc9
jmp 0x40b590
cmp eax, 0x6bdaf69c
jg 0x40b6e4
cmp eax, 0x6ab13282
jg 0x40b702
cmp eax, 0x62e92e49
jg 0x40b771
cmp eax, 0x5ad02053
jg 0x40b7a3
cmp eax, 0x59894769
jg 0x40b7d9
cmp eax, 0x498b27ee
jg 0x40b81e
cmp eax, 0x438c8293
jg 0x40b861
cmp eax, 0x2a3f56fa
jg 0x40b87f
cmp eax, 0xfe502ba
jg 0x40b8a7
cmp eax, 0xef465ab8
jg 0x40b8e7
cmp eax, 0xdefdcfcc
jg 0x40b90a
cmp eax, 0xdd4961c5
je 0x40b92e
cmp eax, 0xddea7bc9
jne 0x40b93a
mov eax, 0x5ad02054
cmp dword [ebp - 0x2c], 0
jne 0x40b6dc
mov eax, 0x438c8294
mov dword [ebp - 0x38], eax
jmp 0x40b590
cmp eax, 0x6bdaf69d
jne 0x40b590
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x38], 0x2a3f56fb
jmp 0x40b590
cmp eax, 0x6ab13283
jne 0x40b590
mov eax, dword [ebp - 0x28]
inc eax
mov ecx, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 8], 0x20
call fcn.00402ce0
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
mov ecx, eax
not ecx
and eax, 0x74
mov edx, ecx
and edx, 0x8b
add edx, eax
xor edx, 0x8a
and ecx, 0xfffffffe
or ecx, edx
mov eax, ecx
not eax
and eax, 0xf5
and ecx, 0x71c7b30a
add ecx, eax
xor ecx, 0x71c7b30a
setne byte [ebp - 9]
mov dword [ebp - 0x38], 0xdefdcfcd
jmp 0x40b590
cmp eax, 0x62e92e4a
jne 0x40b590
mov eax, dword [ebp - 0x28]
inc eax
mov ecx, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 8], 0x20
call fcn.00402ce0
mov dword [ebp - 0x38], 0x6ab13283
jmp 0x40b590
cmp eax, 0x5ad02054
jne 0x40b590
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_VirtualFree]
sub esp, 0xc
mov dword [ebp - 0x38], 0x438c8294
jmp 0x40b590
cmp eax, 0x5989476a
jne 0x40b590
call fcn.0040c020
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfa
and eax, 5
add eax, edx
xor eax, 0xf9
or eax, ecx
cmp eax, 0xffffffff
mov eax, 0x7ad15047
jne 0x40b816
mov eax, 0xfe502bb
mov dword [ebp - 0x38], eax
jmp 0x40b590
cmp eax, 0x498b27ef
jne 0x40b590
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 5]
mov edx, dword [ebp - 0x2c]
add edx, dword [eax + 1]
add eax, 0xd
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00402ce0
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 5]
lea eax, [eax + ecx + 0xd]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x38], 0xbdd2369c
jmp 0x40b590
cmp eax, 0x438c8294
jne 0x40b590
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x38], 0xa1f0bd5b
jmp 0x40b590
cmp eax, 0x2a3f56fb
jne 0x40b590
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x20]
mov eax, 0x498b27ef
cmp ecx, dword [edx + 0xd]
jb 0x40b89f
mov eax, 0xdd4961c5
mov dword [ebp - 0x38], eax
jmp 0x40b590
cmp eax, 0xfe502bb
jne 0x40b590
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
add eax, dword [ecx + 0x11]
mov ecx, dword [ecx + 0xd]
mov edx, dword [ebp - 0x2c]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call fcn.0040af60
test eax, eax
mov eax, 0x824df079
js 0x40b8df
mov eax, 0x8bf0ad71
mov dword [ebp - 0x38], eax
jmp 0x40b590
cmp eax, 0xef465ab9
jne 0x40b590
mov eax, 0x6bdaf69d
cmp dword [ebp - 0x10], 0
jne 0x40b902
mov eax, 0xcded9544
mov dword [ebp - 0x38], eax
jmp 0x40b590
cmp eax, 0xdefdcfcd
jne 0x40b590
mov al, byte [ebp - 9]
test al, al
mov eax, 0xddfaa97c
jne 0x40b926
mov eax, 0x5989476a
mov dword [ebp - 0x38], eax
jmp 0x40b590
mov dword [ebp - 0x38], 0x6ab13283
jmp 0x40b590
cmp eax, 0xddfaa97c
jne 0x40b590
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx + 1]
add ecx, eax
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.0040a130
mov dword [ebp - 0x38], 0x5989476a
jmp 0x40b590
mov eax, dword [ebp - 0x14]
add esp, 0x40
pop esi
pop edi
pop ebp
ret