Function at 0x406dea
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x45b480]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov dword [ebp - 0x808], ecx
push esi
inc ebx
xor eax, eax
push edi
mov edx, ebx
mov edi, 0x47d228
lock cmpxchg dword [edi], edx
cmp eax, 2
je 0x406c91
xor esi, esi
cmp eax, ebx
jne 0x406c80
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x406c84
test eax, eax
je 0x406ca7
mov ecx, ebx
xor eax, eax
lock cmpxchg dword [edi], ecx
cmp eax, 2
jne 0x406c73
mov esi, 0xb7
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004488a4
leave
ret
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [0x47d22c], esi
jne 0x406d75
mov ecx, str.dbghelp.dll
call fcn.00438363
mov edi, eax
test edi, edi
jne 0x406cd6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x406ebb
push str.MiniDumpWriteDump
push edi
call ebx
mov dword [0x47d22c], eax
test eax, eax
jne 0x406cfb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x406ebb
lea eax, [ebp - 0x810]
push eax
push edi
push 5
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
push ecx
lea edx, [ebp - 0x818]
mov ecx, edi
call fcn.004069cf
pop ecx
test eax, eax
jne 0x406d75
mov eax, dword [ebp - 0x814]
mov ecx, 0x60000
cmp eax, ecx
jae 0x406d39
mov dword [0x45b4b8], 0x7ff
jmp 0x406d75
je 0x406d6b
cmp eax, 0x60001
je 0x406d5f
xor ecx, ecx
add eax, 0xfff9fffe
inc ecx
cmp ecx, eax
sbb eax, eax
and eax, 0x600000
add eax, 0x1fffff
mov dword [0x45b4b8], eax
jmp 0x406d75
mov dword [0x45b4b8], 0x7ffff
jmp 0x406d75
mov dword [0x45b4b8], 0xffff
push 0x44cf60
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call ebx
mov edi, eax
test edi, edi
jne 0x406d98
mov esi, 0x65b
jmp 0x406ebb
push dword [ebp - 0x808]
mov ebx, 0x200
push ebx
push 0x47e230
call fcn.004451a0
add esp, 0xc
test eax, eax
jne 0x406d8e
lea eax, [ebp - 0x404]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x406cc9
cmp eax, ebx
jae 0x406d8e
push ebx
lea eax, [ebp - 0x804]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x406cc9
cmp eax, ebx
jae 0x406d8e
mov ebx, dword [0x45b480]
lea eax, [ebp - 0x404]
xor ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
mov dword [ebp - 0x808], eax
lea eax, [ebp - 0x404]
push ebx
push eax
push str._s_p__d_full.dmp
push 0x47da30
call fcn.0040d466
add esp, 0x14
test eax, eax
jle 0x406d8e
push dword [ebp - 0x808]
lea eax, [ebp - 0x404]
push ebx
push eax
push str._s_p__d.dmp
mov ebx, 0x47de30
push ebx
call fcn.0040d466
add esp, 0x14
test eax, eax
jle 0x406d8e
xor eax, eax
inc eax
push eax
lea eax, [ebp - 0x804]
push eax
push ebx
push 0x47e230
push str.__s____s____s____d_
push 0x47d230
call fcn.0040d495
add esp, 0x18
test eax, eax
jle 0x406d8e
push 0x406aab
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x80c]
push eax
push 0x40
push 5
push edi
call ebx
test eax, eax
je 0x406ebb
mov eax, dword [0x44eb38]
mov dword [edi], eax
mov al, byte [0x44eb3c]
mov byte [edi + 4], al
lea eax, [ebp - 0x810]
push eax
push dword [ebp - 0x80c]
push 5
push edi
call ebx
mov eax, esi
mov ecx, 0x47d228
neg eax
sbb eax, eax
and eax, 0xfffffffe
add eax, 2
xchg dword [ecx], eax
jmp 0x406c96