Function at 0x40bb00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x3c], 0x20c775f6
mov esi, dword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
jmp 0x40bb30
mov dword [ebp - 0x3c], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x3c]
cmp eax, 0x7f62b0d3
jg 0x40bb80
cmp eax, 0x729aeaa2
jg 0x40bba0
cmp eax, 0x6da7b6e7
jg 0x40bbbe
cmp eax, 0x685fbbc8
jg 0x40bbd5
cmp eax, 0x59d88848
jg 0x40bbf5
cmp eax, 0x9233b26b
jg 0x40bc16
cmp eax, 0x8eff4643
jne 0x40bb30
mov dword [ebp - 0x3c], 0xcab4a038
jmp 0x40bb30
cmp eax, 0x7f62b0d4
jne 0x40bb30
mov ecx, dword [ebp - 0x20]
mov eax, 0x94af4c63
cmp dword [ecx], 0
jne 0x40bb1e
mov eax, 0xcfeb4139
jmp 0x40bb1e
cmp eax, 0x729aeaa3
jne 0x40bb30
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov dword [ebp - 0x3c], 0xd7ade45b
jmp 0x40bb30
cmp eax, 0x6da7b6e8
jne 0x40bb30
mov dword [ebp - 0x3c], 0x3de18c99
jmp 0x40bb30
cmp eax, 0x685fbbc9
jne 0x40bb30
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0
mov dword [ebp - 0x3c], 0xbf730caf
jmp 0x40bb30
cmp eax, 0x59d88849
jne 0x40bb30
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x38]
mov dword [ecx], eax
mov dword [ebp - 0x3c], 0x1062b9e1
jmp 0x40bb30
cmp eax, 0x542fbed1
jg 0x40bc6a
cmp eax, 0x514f9354
jg 0x40bc84
cmp eax, 0x94af4c62
jg 0x40bc9b
cmp eax, 0x9233b26c
jne 0x40bb30
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 8], 0x20
call fcn.00402d90
add esp, 0xc
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], 0xe43d6f7e
jmp 0x40bb30
cmp eax, 0x542fbed2
jne 0x40bb30
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], 0xcab4a038
jmp 0x40bb30
cmp eax, 0x514f9355
jne 0x40bb30
mov dword [ebp - 0x3c], 0x7f62b0d4
jmp 0x40bb30
cmp eax, 0x9927e130
jg 0x40bcda
cmp eax, 0x94af4c63
jne 0x40bb30
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [ebp - 0x3c], 0xcfeb4139
jmp 0x40bb30
cmp eax, 0xa11c3b8c
jg 0x40bdf6
cmp eax, 0x9927e131
jne 0x40bb30
mov eax, 4
call fcn.00418710
mov dword [ebp - 0x38], esp
mov eax, 4
call fcn.00418710
mov dword [ebp - 0x34], esp
mov eax, 4
call fcn.00418710
mov dword [ebp - 0x30], esp
mov eax, 4
call fcn.00418710
mov dword [ebp - 0x2c], esp
mov eax, 4
call fcn.00418710
mov dword [ebp - 0x28], esp
mov eax, 4
call fcn.00418710
mov dword [ebp - 0x24], esp
mov eax, 4
call fcn.00418710
mov dword [ebp - 0x20], esp
mov eax, 4
call fcn.00418710
mov dword [ebp - 0x1c], esp
mov eax, 4
call fcn.00418710
mov dword [ebp - 0x18], esp
mov eax, dword [ebp - 0x34]
mov dword [eax], edi
mov eax, dword [ebp - 0x30]
mov dword [eax], ebx
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ecx]
add eax, dword [ecx + 0x11]
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ecx]
add eax, dword [ecx + 0x15]
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
mov eax, dword [ebp - 0x20]
mov dword [eax], 0
mov eax, dword [ebp - 0x18]
mov dword [eax], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov eax, dword [eax + 5]
sub esp, 0x10
mov dword [esp + 4], eax
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
mov eax, dword [ebp - 0x20]
cmp dword [eax], 0
setne byte [ebp - 0x13]
mov dword [ebp - 0x3c], 0x46c28ffa
jmp 0x40bb30
cmp eax, 0xa994e154
jg 0x40be0d
cmp eax, 0xa11c3b8d
jne 0x40bb30
jmp 0x40c4fb
cmp eax, 0xab56e5e8
jg 0x40be5b
cmp eax, 0xa994e155
jne 0x40bb30
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ecx]
add eax, dword [ecx + 0x11]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xd]
mov edx, dword [ebp - 0x20]
mov edx, dword [edx]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call fcn.0040b450
add esp, 0xc
mov dword [ebp - 0x3c], 0xab56e5e9
jmp 0x40bb30
cmp eax, 0xb2c4de12
jg 0x40beaf
cmp eax, 0xab56e5e9
jne 0x40bb30
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ecx]
add eax, dword [ecx + 0x11]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xd]
mov edx, dword [ebp - 0x20]
mov edx, dword [edx]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call fcn.0040b450
add esp, 0xc
test eax, eax
sets byte [ebp - 0x11]
mov dword [ebp - 0x3c], 0x31fa60aa
jmp 0x40bb30
cmp eax, 0x4c510d56
jg 0x40beff
cmp eax, 0x4adbffa3
jg 0x40bf16
cmp eax, 0x46c28ff9
jg 0x40bf51
cmp eax, 0x3de18c98
jg 0x40bf75
cmp eax, 0xb4074e42
jg 0x40bfdf
cmp eax, 0xb2c4de13
jne 0x40bb30
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x38]
mov dword [ecx], eax
mov dword [ebp - 0x3c], 0x59d88849
jmp 0x40bb30
cmp eax, 0x4c510d57
jne 0x40bb30
mov dword [ebp - 0x3c], 0x729aeaa3
jmp 0x40bb30
cmp eax, 0x4adbffa4
jne 0x40bb30
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx]
add eax, dword [ecx + 1]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.0040a820
add esp, 8
mov dword [ebp - 0x3c], 0xc45c197b
jmp 0x40bb30
cmp eax, 0x46c28ffa
jne 0x40bb30
mov al, byte [ebp - 0x13]
test al, al
mov eax, 0x685fbbc9
jne 0x40bf6d
mov eax, 0x1e48ff8d
mov dword [ebp - 0x3c], eax
jmp 0x40bb30
cmp eax, 0x3de18c99
jne 0x40bb30
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov eax, dword [eax + 5]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx]
add ecx, 0xd
mov edx, dword [ebp - 0x20]
mov edx, dword [edx]
mov eax, esi
mov esi, dword [ebp - 0x28]
mov esi, dword [esi]
add edx, dword [esi + 1]
mov esi, eax
sub esp, 0xc
mov eax, dword [ebp - 0x40]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call fcn.00402d90
add esp, 0xc
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 5]
lea eax, [eax + ecx + 0xd]
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
mov dword [ebp - 0x3c], 0xefd4d517
jmp 0x40bb30
cmp eax, 0xb713fd27
jg 0x40c050
cmp eax, 0xb4074e43
jne 0x40bb30
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov eax, dword [eax + 5]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx]
add ecx, 0xd
mov edx, dword [ebp - 0x20]
mov edx, dword [edx]
mov eax, esi
mov esi, dword [ebp - 0x28]
mov esi, dword [esi]
add edx, dword [esi + 1]
mov esi, eax
sub esp, 0xc
mov eax, dword [ebp - 0x40]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call fcn.00402d90
add esp, 0xc
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 5]
lea eax, [eax + ecx + 0xd]
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
mov dword [ebp - 0x3c], 0x3de18c99
jmp 0x40bb30
cmp eax, 0xbf730cae
jg 0x40c08b
cmp eax, 0xb713fd28
jne 0x40bb30
call fcn.0040f460
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
movzx eax, byte [eax]
not eax
or eax, 0xfffffffc
cmp eax, 0xffffffff
mov eax, 0x1dfeae1c
jne 0x40c083
mov eax, 0x23edab42
mov dword [ebp - 0x3c], eax
jmp 0x40bb30
cmp eax, 0xc45c197a
jg 0x40c0be
cmp eax, 0xbf730caf
jne 0x40bb30
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov eax, 0x6da7b6e8
cmp ecx, dword [edx + 0xd]
jb 0x40c0b6
mov eax, 0x1494843b
mov dword [ebp - 0x3c], eax
jmp 0x40bb30
cmp eax, 0x393d24c0
jg 0x40c12c
cmp eax, 0x38190743
jg 0x40c150
cmp eax, 0x31fa60a9
jg 0x40c230
cmp eax, 0x23edab41
jg 0x40c254
cmp eax, 0xc52fa181
jg 0x40c26b
cmp eax, 0xc45c197b
jne 0x40bb30
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx]
add eax, dword [ecx + 1]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.0040a820
add esp, 8
mov dword [ebp - 0x3c], 0xe601baf3
jmp 0x40bb30
cmp eax, 0x393d24c1
jne 0x40bb30
mov al, byte [ebp - 0x12]
test al, al
mov eax, 0x20915d8a
jne 0x40c148
mov eax, 0xb713fd28
mov dword [ebp - 0x3c], eax
jmp 0x40bb30
cmp eax, 0x38190744
jne 0x40bb30
mov eax, 4
call fcn.00418710
mov eax, 4
call fcn.00418710
mov dword [ebp - 0x44], esp
mov eax, 4
call fcn.00418710
mov edx, esp
mov eax, 4
call fcn.00418710
mov esi, esp
mov eax, 4
call fcn.00418710
mov ecx, esp
mov eax, 4
call fcn.00418710
mov dword [ebp - 0x48], esp
mov eax, 4
call fcn.00418710
mov dword [ebp - 0x40], esp
mov eax, 4
call fcn.00418710
mov eax, 4
call fcn.00418710
mov eax, dword [ebp - 0x44]
mov dword [eax], edi
mov dword [edx], ebx
mov dword [esi], ebx
mov eax, dword [edx]
add eax, dword [ebx + 0x11]
mov dword [ecx], eax
mov eax, dword [edx]
mov ecx, dword [esi]
add eax, dword [ecx + 0x15]
mov ecx, dword [ebp - 0x48]
mov dword [ecx], eax
mov eax, dword [ebp - 0x40]
mov dword [eax], 0
mov dword [esp], 0
mov eax, dword [esi]
mov esi, dword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
mov eax, dword [eax + 5]
sub esp, 0x10
mov dword [esp + 4], eax
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebp - 0x40]
mov dword [ecx], eax
mov dword [ebp - 0x3c], 0x9927e131
jmp 0x40bb30
cmp eax, 0x31fa60aa
jne 0x40bb30
mov al, byte [ebp - 0x11]
test al, al
mov eax, 0x514f9355
jne 0x40c24c
mov eax, 0xda279951
mov dword [ebp - 0x3c], eax
jmp 0x40bb30
cmp eax, 0x23edab42
jne 0x40bb30
mov dword [ebp - 0x3c], 0xab56e5e9
jmp 0x40bb30
cmp eax, 0xcab4a037
jg 0x40c292
cmp eax, 0xc52fa182
jne 0x40bb30
mov eax, dword [ebp - 0x38]
mov dword [eax], 0
mov dword [ebp - 0x3c], 0xe9215166
jmp 0x40bb30
cmp eax, 0xcfeb4138
jg 0x40c2b8
cmp eax, 0xcab4a038
jne 0x40bb30
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x3c], 0xa11c3b8d
jmp 0x40bb30
cmp eax, 0xd7ade45a
jg 0x40c2d6
cmp eax, 0xcfeb4139
jne 0x40bb30
mov dword [ebp - 0x3c], 0xe9215166
jmp 0x40bb30
cmp eax, 0xda279950
jg 0x40c2f4
cmp eax, 0xd7ade45b
jne 0x40bb30
mov dword [ebp - 0x3c], 0xbf730caf
jmp 0x40bb30
cmp eax, 0xe43d6f7d
jg 0x40c312
cmp eax, 0xda279951
jne 0x40bb30
mov dword [ebp - 0x3c], 0x59d88849
jmp 0x40bb30
cmp eax, 0xe601baf2
jg 0x40c369
cmp eax, 0xe43d6f7e
jne 0x40bb30
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 8], 0x20
call fcn.00402d90
add esp, 0xc
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
movzx eax, byte [eax]
not eax
or eax, 0xfffffffe
cmp eax, 0xffffffff
setne byte [ebp - 0x12]
mov dword [ebp - 0x3c], 0x393d24c1
jmp 0x40bb30
cmp eax, 0xe9215165
jg 0x40c387
cmp eax, 0xe601baf3
jne 0x40bb30
mov dword [ebp - 0x3c], 0xb713fd28
jmp 0x40bb30
cmp eax, 0xefd4d516
jg 0x40c3ae
cmp eax, 0xe9215166
jne 0x40bb30
mov eax, dword [ebp - 0x38]
mov dword [eax], 0
mov dword [ebp - 0x3c], 0x14b41843
jmp 0x40bb30
cmp eax, 0xff0cda06
jg 0x40c3cc
cmp eax, 0xefd4d517
jne 0x40bb30
mov dword [ebp - 0x3c], 0x4c510d57
jmp 0x40bb30
cmp eax, 0x1062b9e0
jg 0x40c3f5
cmp eax, 0xff0cda07
jne 0x40bb30
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov dword [ebp - 0x3c], 0x729aeaa3
jmp 0x40bb30
cmp eax, 0x1494843a
jg 0x40c413
cmp eax, 0x1062b9e1
jne 0x40bb30
mov dword [ebp - 0x3c], 0x8eff4643
jmp 0x40bb30
cmp eax, 0x20c775f5
jg 0x40c442
cmp eax, 0x20915d89
jg 0x40c459
cmp eax, 0x1e48ff8c
jg 0x40c470
cmp eax, 0x1494843b
je 0x40c48d
cmp eax, 0x14b41843
jne 0x40c499
mov dword [ebp - 0x3c], 0x8eff4643
jmp 0x40bb30
cmp eax, 0x20c775f6
jne 0x40bb30
mov dword [ebp - 0x3c], 0x9927e131
jmp 0x40bb30
cmp eax, 0x20915d8a
jne 0x40bb30
mov dword [ebp - 0x3c], 0xc45c197b
jmp 0x40bb30
cmp eax, 0x1e48ff8d
jne 0x40bb30
mov eax, esi
mov esi, dword [eax]
mov esi, eax
mov dword [ebp - 0x3c], 0x7f62b0d4
jmp 0x40bb30
mov dword [ebp - 0x3c], 0xe43d6f7e
jmp 0x40bb30
cmp eax, 0x1dfeae1c
jne 0x40bb30
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ecx]
mov edx, 0xa6bd4604
sub edx, dword [ecx + 1]
lea eax, [edx + eax + 0x5942b9fc]
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx]
add eax, dword [ecx + 0x19]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x20]
mov edx, dword [edx]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call fcn.0040acb0
add esp, 0xc
mov dword [ebp - 0x3c], 0x23edab42
jmp 0x40bb30
mov eax, dword [ebp - 0x10]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret