Function at 0x30024408
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x58]
mov edx, dword [0x30018fe4]
call fcn.30015afc
xor eax, eax
push ebp
push 0x30024797
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x3003fca0], 0
jne 0x30024766
call sub.KERNEL32.dll_GetVersion
test eax, 0x80000000
je 0x300244ac
push 0
mov dl, 1
mov eax, 0x300247b0
call fcn.3001b770
call fcn.3001f308
push eax
push 0x30024220
push 0x3003fc90
push 0
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.3002488c
push 0
mov dl, 1
mov eax, 0x300247c8
call fcn.3001b770
call fcn.3001f308
push eax
push 0x30024288
push 0x3003fc94
push 0
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.3002488c
jmp 0x3002475f
cmp byte [0x3003fca4], 0
jne 0x3002470a
mov byte [0x3003fca4], 1
lea edx, [ebp - 0xc]
mov eax, 0x300247e0
call fcn.30017d04
lea eax, [ebp - 0x60]
push eax
call sub.KERNEL32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.30017998
mov ecx, dword [ebp - 0x60]
lea eax, [ebp - 0x5c]
mov edx, dword [ebp - 0xc]
call fcn.30015794
mov eax, dword [ebp - 0x5c]
call fcn.30015948
push eax
push 0xc
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.KERNEL32.dll_CreateFileMappingA
mov esi, eax
test esi, esi
je 0x3002470a
call sub.KERNEL32.dll_GetLastError
cmp eax, 0xb7
setne byte [ebp - 1]
push 0
push 0
push 0
push 0xf001f
push esi
call sub.KERNEL32.dll_MapViewOfFile
mov edi, eax
test edi, edi
je 0x30024700
mov ebx, 0x32
cmp byte [ebp - 1], 0
jne 0x3002456c
mov eax, dword [edi]
mov edx, dword [edi + 4]
push edx
push eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 4]
mov eax, dword [eax]
cmp edx, dword [esp + 4]
jne 0x3002455e
cmp eax, dword [esp]
pop edx
pop eax
je 0x3002456c
push 0x32
call sub.KERNEL32.dll_Sleep
dec ebx
jne 0x30024540
cmp byte [ebp - 1], 0
jne 0x30024587
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov ecx, dword [ebp - 0xc]
cmp edx, dword [ecx + 4]
jne 0x30024581
cmp eax, dword [ecx]
je 0x300246f2
push 0x40
push 0x1000
push 0xa
push 0
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
mov dl, 1
mov eax, 0x300247f4
call fcn.3001b86c
mov dword [ebp - 0x14], eax
mov dl, 1
mov eax, 0x30024808
call fcn.3001b770
lea edx, [ebp - 0x58]
call fcn.3001b6a4
mov eax, dword [ebp - 0x38]
call fcn.30016034
test eax, eax
jl 0x300246c2
inc eax
xor ebx, ebx
mov edx, ebx
shl edx, 3
sub edx, ebx
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + edx*4 + 0xc]
cmp edx, dword [ebp - 0x14]
jne 0x300246ba
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 0x38]
cmp dword [edx + eax*4 + 0x14], 0
je 0x300246c2
mov eax, dword [ebp - 8]
mov dword [edi + 8], eax
mov eax, dword [ebp - 8]
mov byte [eax], 0xff
mov eax, dword [ebp - 8]
mov byte [eax + 1], 0x25
mov eax, dword [ebp - 8]
add eax, 6
mov edx, dword [ebp - 8]
mov dword [edx + 2], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
mov dword [eax + 6], edx
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + eax*4 + 0x14]
call fcn.3001c790
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x3002465c
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + eax*4 + 0x14]
mov edx, 4
call fcn.3001c870
test al, al
je 0x300246c2
mov esi, ebx
shl esi, 3
sub esi, ebx
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 8]
sub edx, dword [eax + esi*4 + 4]
sub edx, 5
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x38]
mov edx, dword [eax + esi*4 + 0x14]
lea eax, [ebp - 0x10]
mov ecx, 4
call fcn.3001e5bc
test al, al
jne 0x30024697
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + esi*4 + 0x14]
mov edx, dword [ebp - 0x10]
mov dword [eax], edx
cmp byte [ebp - 0x15], 0
je 0x300246ae
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + esi*4 + 0x14]
mov edx, 4
call fcn.3001c900
mov eax, dword [ebp - 8]
mov dword [0x3003fca8], eax
xor esi, esi
jmp 0x300246c2
inc ebx
dec eax
jne 0x300245d0
cmp dword [0x3003fca8], 0
jne 0x300246e3
push edi
call sub.KERNEL32.dll_UnmapViewOfFile
push 0x8000
push 0
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.dll_VirtualFree
jmp 0x30024700
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
mov dword [edi], edx
mov edx, dword [eax + 4]
mov dword [edi + 4], edx
jmp 0x30024700
mov eax, dword [edi + 8]
mov dword [0x3003fca8], eax
push edi
call sub.KERNEL32.dll_UnmapViewOfFile
test esi, esi
je 0x3002470a
push esi
call sub.KERNEL32.dll_CloseHandle
cmp dword [0x3003fca8], 0
je 0x30024734
push 0
mov eax, dword [0x3003fca8]
push eax
push 0x30024380
push 0x3003fc9c
push 0
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.3002488c
jmp 0x3002475f
push 0
mov eax, 0x30024808
mov dl, 1
call fcn.3001b770
call fcn.3001f308
push eax
push 0x30024304
push 0x3003fc98
push 0
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.3002488c
mov byte [0x3003fca0], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3002479e
lea eax, [ebp - 0x60]
mov edx, 2
call fcn.3001550c
lea eax, [ebp - 0x58]
mov edx, dword [0x30018fe4]
call fcn.30015bc0
lea eax, [ebp - 0xc]
call fcn.300154e8
ret