Function at 0x409d10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x3c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x18]
add ecx, dword [eax + 0x11]
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
add eax, dword [ecx + 0x15]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 5]
mov dword [esp + 4], eax
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub esp, 0x10
mov dword [ebp - 0x28], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x34], 0x4dcb93ba
mov edi, dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidA]
jmp 0x409dc0
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 5]
mov edx, dword [ebp - 0x28]
add edx, dword [eax + 1]
add eax, 0xd
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00402630
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 5]
lea eax, [eax + ecx + 0xd]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], 0xd275fb92
nop
nop
nop
nop
mov eax, dword [ebp - 0x34]
cmp eax, 0x9df7ab12
jg 0x409de0
cmp eax, 0x83e4b4f7
jne 0x409dc0
jmp 0x409d89
cmp eax, 0x5e9a182d
jg 0x409e50
cmp eax, 0x5b2ad314
jg 0x409e6e
cmp eax, 0x51c82a9f
jg 0x409e85
cmp eax, 0x4dcb93b9
jg 0x409efc
cmp eax, 0x3bd958d6
jg 0x409f1f
cmp eax, 0x269ea2ab
jg 0x409f47
cmp eax, 0x1fa0f819
jg 0x409f57
cmp eax, 0x9fc246d4
jg 0x409f75
cmp eax, 0x9df7ab13
jne 0x409dc0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x34], 0x1fa0f81a
jmp 0x409dc0
cmp eax, 0x5e9a182e
jne 0x409dc0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x34], 0x269ea2ac
jmp 0x409dc0
cmp eax, 0x5b2ad315
jne 0x409dc0
mov dword [ebp - 0x34], 0x3bd958d7
jmp 0x409dc0
cmp eax, 0x51c82aa0
jne 0x409dc0
mov eax, dword [ebp - 0x24]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 8], 0x20
call fcn.00402630
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
mov ecx, eax
not ecx
and ecx, 0x9eafa9f0
and eax, 0xf
add eax, ecx
mov ecx, eax
xor ecx, 0x6150560e
and ecx, 0xfffffffe
xor eax, 0x9eafa9f1
or eax, ecx
mov ecx, eax
not ecx
and ecx, 0x2036bf77
and eax, 0xdfc94088
add eax, ecx
xor eax, 0xdfc94088
mov eax, 0xef5e988b
jne 0x409ef4
mov eax, 0xc430ed5e
mov dword [ebp - 0x34], eax
jmp 0x409dc0
cmp eax, 0x4dcb93ba
jne 0x409dc0
mov eax, 0xc39d3e9
cmp dword [ebp - 0xc], 0
jne 0x409f17
mov eax, 0xbffc0d0e
mov dword [ebp - 0x34], eax
jmp 0x409dc0
cmp eax, 0x3bd958d7
jne 0x409dc0
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
mov eax, 0x83e4b4f7
cmp ecx, dword [edx + 0xd]
jb 0x409f3f
mov eax, 0x51c82aa0
mov dword [ebp - 0x34], eax
jmp 0x409dc0
cmp eax, 0x269ea2ac
jne 0x409dc0
jmp 0x40a1d0
cmp eax, 0x1fa0f81a
jne 0x409dc0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x34], 0xf16bd9dd
jmp 0x409dc0
cmp eax, 0xbffc0d0d
jg 0x409f93
cmp eax, 0x9fc246d5
jne 0x409dc0
mov dword [ebp - 0x34], 0x1fa0f81a
jmp 0x409dc0
cmp eax, 0xc430ed5d
jg 0x409fb3
cmp eax, 0xbffc0d0e
jne 0x409dc0
mov esi, dword [edi]
mov dword [ebp - 0x34], 0x4d4f629
jmp 0x409dc0
cmp eax, 0xc85f419c
jg 0x409ff5
cmp eax, 0xc430ed5e
jne 0x409dc0
call fcn.0040bdf0
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
mov ecx, eax
not ecx
and ecx, 0xfc
xor eax, 3
or eax, ecx
xor al, 0xff
mov eax, 0xed4bfcb4
jne 0x409fed
mov eax, 0xaeba053
mov dword [ebp - 0x34], eax
jmp 0x409dc0
cmp eax, 0xce6c30a8
jg 0x40a019
cmp eax, 0xc85f419d
jne 0x409dc0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x34], 0x269ea2ac
jmp 0x409dc0
cmp eax, 0xd275fb91
jg 0x40a03e
cmp eax, 0xce6c30a9
jne 0x409dc0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x34], 0x5b2ad315
jmp 0x409dc0
cmp eax, 0xdfe03e70
jg 0x40a05f
cmp eax, 0xd275fb92
jne 0x409dc0
inc dword [ebp - 0x2c]
mov dword [ebp - 0x34], 0x3bd958d7
jmp 0x409dc0
cmp eax, 0xed4bfcb3
jg 0x40a07d
cmp eax, 0xdfe03e71
jne 0x409dc0
mov dword [ebp - 0x34], 0x4d4f629
jmp 0x409dc0
cmp eax, 0xef5e988a
jg 0x40a0ce
cmp eax, 0xed4bfcb4
jne 0x409dc0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x3e5087b0
sub edx, dword [ecx + 1]
lea eax, [edx + eax - 0x3e5087b0]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov edx, dword [edx + 0x19]
add edx, ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.004092d0
mov dword [ebp - 0x34], 0xaeba053
jmp 0x409dc0
cmp eax, 0xf16bd9dc
jg 0x40a103
cmp eax, 0xef5e988b
jne 0x409dc0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx + 1]
add ecx, eax
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.00408a70
mov dword [ebp - 0x34], 0xc430ed5e
jmp 0x409dc0
cmp eax, 0x21f0960
jg 0x40a121
cmp eax, 0xf16bd9dd
jne 0x409dc0
mov dword [ebp - 0x34], 0xce6c30a9
jmp 0x409dc0
cmp eax, 0x4d4f628
jg 0x40a15e
cmp eax, 0x21f0961
jne 0x409dc0
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_VirtualFree]
sub esp, 0xc
mov dword [ebp - 0x34], 0x5e9a182e
jmp 0x409dc0
cmp eax, 0x4d4f629
je 0x40a1a1
cmp eax, 0xaeba053
jne 0x40a1b9
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
add eax, dword [ecx + 0x11]
mov ecx, dword [ecx + 0xd]
mov edx, dword [ebp - 0x28]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call fcn.00409730
test eax, eax
mov eax, 0xdfe03e71
js 0x40a199
mov eax, 0xc85f419d
mov dword [ebp - 0x34], eax
jmp 0x409dc0
mov eax, 0x21f0961
cmp dword [ebp - 0x28], 0
jne 0x40a1b1
mov eax, 0x5e9a182e
mov dword [ebp - 0x34], eax
jmp 0x409dc0
cmp eax, 0xc39d3e9
jne 0x409dc0
mov dword [ebp - 0x34], 0xce6c30a9
jmp 0x409dc0
mov eax, dword [ebp - 0x10]
add esp, 0x3c
pop esi
pop edi
pop ebp
ret