Function at 0x1113d900
Capabilities:
Allocate or change rwx memory
Check for software breakpoints

Disassembly:
mov eax, dword [esp + 0x18]
sub esp, 0x28
push ebx
push ebp
xor ebp, ebp
xor ebx, ebx
push esi
cmp eax, 5
push edi
jb 0x1113d919
cmp eax, 0x1b
jb 0x1113d921
mov dword [esp + 0x50], 6
mov eax, dword [esp + 0x44]
cmp eax, ebp
je 0x1113d92b
mov dword [eax], ebp
mov eax, dword [esp + 0x48]
cmp eax, ebp
je 0x1113d935
mov dword [eax], ebp
mov esi, dword [esp + 0x4c]
cmp esi, ebp
je 0x1113d93f
mov dword [esi], ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x111e14a0], eax
je 0x1113d95c
pop edi
pop esi
pop ebp
mov eax, 0x10dd
pop ebx
add esp, 0x28
ret 0x18
mov eax, dword [0x111e14a4]
cmp eax, ebp
jne 0x1113dcc2
mov ecx, dword [esp + 0x3c]
cmp ecx, ebp
jne 0x1113d980
pop edi
pop esi
pop ebp
mov eax, 6
pop ebx
add esp, 0x28
ret 0x18
mov eax, dword [ecx]
cmp eax, ebp
jne 0x1113d9a0
pop edi
mov eax, 6
pop esi
pop ebp
mov dword [0x111e14a4], eax
mov dword [0x111e14a8], ecx
pop ebx
add esp, 0x28
ret 0x18
push ebp
push ebp
push eax
mov dword [esp + 0x58], ebp
call fcn.1113d230
mov edi, eax
push 0
mov eax, dword [esp + 0x44]
push 0
push eax
mov dword [esp + 0x24], edi
call fcn.1113d230
cmp eax, edi
mov dword [esp + 0x40], eax
jne 0x1113d9da
mov eax, dword [0x111e149c]
test eax, eax
jne 0x1113dc68
jmp 0x1113dc44
mov ecx, dword [esp + 0x48]
test ecx, ecx
je 0x1113d9e4
mov dword [ecx], edi
test esi, esi
je 0x1113d9ea
mov dword [esi], eax
push 0x18
call fcn.1113f6a0
add esp, 4
mov dword [esp + 0x4c], eax
test eax, eax
jne 0x1113da06
mov ebx, 8
jmp 0x1113dc44
call fcn.1113f690
push 0x10f00000
push edi
call fcn.1113dcd0
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x1113da3d
push 0x71000000
push edi
call fcn.1113dcd0
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x1113da3d
mov ebx, 8
jmp 0x1113dc44
mov eax, dword [esp + 0x44]
test eax, eax
je 0x1113da47
mov dword [eax], ebp
mov ecx, dword [esp + 0x50]
xor ebx, ebx
xor esi, esi
mov eax, edi
test ecx, ecx
mov dword [esp + 0x44], esi
jle 0x1113db35
mov dword [esp + 0x48], 0
mov cl, byte [eax]
cmp cl, 0x64
mov dword [esp + 0x14], eax
jne 0x1113daa6
cmp byte [eax + 1], 0xff
jne 0x1113daa6
mov cl, byte [eax + 2]
cmp cl, 0x15
je 0x1113da83
cmp cl, 0x25
jne 0x1113daa6
mov edx, eax
lea ecx, [ebx + ebp]
add eax, 7
add ebx, 7
mov esi, dword [edx]
mov dword [ecx], esi
mov si, word [edx + 4]
mov word [ecx + 4], si
mov esi, dword [esp + 0x44]
mov dl, byte [edx + 6]
mov byte [ecx + 6], dl
jmp 0x1113dac3
lea ecx, [esp + 0x48]
lea edx, [ebx + ebp]
push ecx
push 0
push eax
push edx
call fcn.1113f0d0
mov ecx, dword [esp + 0x48]
test ecx, ecx
jne 0x1113db30
mov ebx, eax
sub ebx, edi
test esi, esi
jne 0x1113dad2
cmp ebx, 5
jl 0x1113dad2
mov esi, ebx
mov dword [esp + 0x44], esi
mov edx, dword [esp + 0x14]
mov cl, byte [edx]
cmp cl, 0xe9
je 0x1113db30
cmp cl, 0xe0
je 0x1113db30
cmp cl, 0xc2
je 0x1113db30
cmp cl, 0xc3
je 0x1113db30
cmp cl, 0xcc
je 0x1113db30
cmp cl, 0xff
jne 0x1113dafc
cmp byte [edx + 1], 0x25
je 0x1113db30
cmp cl, 0x26
je 0x1113db1a
cmp cl, 0x2e
je 0x1113db1a
cmp cl, 0x36
je 0x1113db1a
cmp cl, 0xe3
je 0x1113db1a
cmp cl, 0x64
je 0x1113db1a
cmp cl, 0x65
jne 0x1113db26
cmp byte [edx + 1], 0xff
jne 0x1113db26
cmp byte [edx + 2], 0x25
je 0x1113db30
cmp ebx, dword [esp + 0x50]
jl 0x1113da5d
cmp ebx, 5
jge 0x1113db4c
mov eax, dword [0x111e149c]
mov ebx, 9
test eax, eax
jne 0x1113dc4a
jmp 0x1113dc44
cmp ebx, 0x12
jbe 0x1113db5b
mov ebx, 6
jmp 0x1113dc44
mov eax, dword [esp + 0x40]
lea ecx, [ebp + 0x17]
mov dword [ebp + 0x20], eax
lea edx, [ebx + edi]
add esi, edi
lea eax, [ebx + ebp]
mov dword [ebp + 0x18], edx
mov dword [ebp + 0x1c], esi
mov byte [ecx], bl
lea esi, [eax + 5]
mov byte [eax], 0xe9
inc eax
sub edx, esi
lea edi, [eax + 4]
mov dword [eax], edx
cmp edi, ecx
jae 0x1113db9c
sub ecx, edi
mov eax, 0x90909090
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x10]
xor esi, esi
push eax
push 0x40
push ebx
mov ebx, dword [esp + 0x24]
push ebx
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1113dbe1
mov ecx, 6
lea edi, [esp + 0x20]
mov dword [esp + 0x1c], esi
push 0x1c
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x20]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1113dc42
test byte [esp + 0x30], 0x40
je 0x1113dc42
push ebx
call fcn.1113df10
mov esi, eax
xor edi, edi
add esp, 4
cmp esi, edi
je 0x1113dc98
cmp word [esi + 0x1c], 0x6544
je 0x1113dc98
lea edx, [esp + 0x50]
mov dword [esp + 0x50], edi
push edx
push 0x40
push 0x40
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1113dc80
mov dword [esp + 0x1c], edi
mov ecx, 6
lea edi, [esp + 0x20]
push 0x1c
rep stosd dword es:[edi], eax
lea eax, [esp + 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1113dc42
test byte [esp + 0x30], 0x40
jne 0x1113dc7e
xor ebx, ebx
mov dword [0x111e14a4], ebx
test ebp, ebp
je 0x1113dc57
push ebp
call fcn.1113d530
add esp, 4
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x1113dc68
push eax
call fcn.1113f6ae
add esp, 4
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
mov eax, ebx
pop ebp
mov dword [0x111e14a8], ecx
pop ebx
add esp, 0x28
ret 0x18
xor edi, edi
mov word [esi + 0x1c], 0x6544
mov word [esi + 0x1e], 0x6f74
mov word [esi + 0x20], 0x7275
mov word [esi + 0x22], 0x2173
mov eax, dword [esp + 0x4c]
mov edx, dword [esp + 0x3c]
mov dword [eax + 4], edi
mov dword [eax + 8], edx
mov dword [eax + 0x10], ebp
mov dword [eax + 0xc], ebx
mov ecx, dword [esp + 0x10]
mov dword [eax + 0x14], ecx
mov edx, dword [0x111e14b0]
mov dword [eax], edx
mov dword [0x111e14b0], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 0x18