Function at 0x4672e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x138
mov eax, dword [0x4b000c]
xor eax, esp
mov dword [esp + 0x134], eax
push esi
push edi
push 0x104
lea eax, [esp + 0x34]
mov byte [0xbf9586], 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x467358
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [esp + ecx + 0x30]
lea ecx, [ecx + 1]
mov byte [ecx + 0x4d1f17], al
test al, al
jne 0x467320
mov ecx, str.exceptions.log
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x467337
mov eax, dword [str..exp.log]
mov dword [ecx], eax
mov eax, dword [0x4a8ea0]
mov dword [ecx + 4], eax
mov al, byte [0x4a8ea4]
mov byte [ecx + 8], al
cmp dword [0xbcf97c], 0
jne 0x467400
push 0x464220
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x4673f6
push 0x4a8dd0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x4673f6
lea eax, [esp + 8]
mov dword [esp + 0x28], 0x4c2c033
push eax
push 0x40
push 5
push edi
mov byte [esp + 0x3c], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, eax
mov dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
push 5
lea eax, [esp + 0x30]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test esi, esi
je 0x4673f6
mov eax, dword [esp + 8]
cmp eax, 0x40
je 0x4673f6
lea ecx, [esp + 0x10]
push ecx
push eax
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [0xbcf97c], 1
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0xe00140
mov dword [esp + 0x24], 0x43c0000
call fcn.0044a930
test al, al
je 0x467723
mov ecx, dword [0x73c09c]
mov eax, 0x3c
sub eax, ecx
mov byte [0xbfabc0], 0
mov word [0xbfbc84], ax
push 0x250
lea eax, [ecx - 0x3a]
mov dword [0x73c194], 0x3f800000
mov word [0xbfbc86], ax
mov ax, word [0x73c09e]
sub ax, 0x10
mov byte [0xbefbc8], 1
push 0x80
push 0x73dd60
mov byte [0xbefbd0], 1
mov dword [0x4b17f8], 1
mov dword [0x4b17f4], 1
mov byte [0xbfce70], 0
mov dword [0x792b9c], 0
mov dword [0x792ba0], 0
mov byte [0xbfbccc], 1
mov dword [0xbfabbc], 0
mov dword [0xbfaba8], 0
mov dword [0x4b17ec], 0xff
mov byte [0xbfd030], 4
mov word [0xbfd03e], 0x404
mov word [0xbfd1d6], ax
mov word [0xbfd1d4], ax
mov dword [0xbfc694], 0
mov dword [0xbfc690], 0
call fcn.0046e200
push 0x4a0
push 0xff
push 0x73d418
call fcn.0046e200
push 0x4a0
push 0xff
push 0x73d8c0
call fcn.0046e200
add esp, 0x24
mov dword [0x73d8b8], 0x4b49cc
mov dword [0x73dfb0], 0x4b49d4
mov ecx, 0x44d3e0
mov byte [0x4db8a9], 0
call fcn.00404d00
test eax, eax
jns 0x467559
mov byte [0x4db8a9], 1
cmp byte [0x4db8a9], 0
jne 0x467583
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004050a0
cmp dword [0x4d3824], 0
je 0x46757a
push 0x64
call esi
cmp byte [0x4db8a9], 0
je 0x467568
call fcn.004683b0
mov dx, word [0xbf957a]
mov dword [0xbfabb8], 0
cmp dx, 0x39
jae 0x4675f1
mov eax, dword [0xbefbcc]
movzx ecx, dx
inc dx
mov word [0xbf957a], dx
mov esi, dword [eax + ecx*4]
or eax, 0xffffffff
push esi
mov dword [esi + 0x1d0], 0
mov byte [esi + 0x1f1], 0x25
mov word [esi + 0x1ec], ax
mov dword [esi + 0x178], 0
mov dword [esi + 0x278], fcn.00463070
call fcn.00463070
add esp, 4
mov dword [0xbfaba0], esi
xorps xmm0, xmm0
mov dword [0x4e9c30], 0
movups xmmword [0x4e9c20], xmm0
call fcn.00447070
test al, al
je 0x467723
xorps xmm0, xmm0
mov dword [0x4e9c30], 0
movups xmmword [0x4e9c20], xmm0
call fcn.0044c720
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test al, al
jne 0x4676e1
nop
push ecx
call fcn.0044b910
add esp, 4
mov ecx, 0x20003
call fcn.00404fc0
test eax, eax
mov eax, dword [0xc0d848]
jne 0x467699
test eax, eax
je 0x467665
push 0xffffffffffffffff
push eax
call esi
cmp dword [0x7aa688], 0
jne 0x467686
mov eax, dword [0x4d9b7c]
mov eax, dword [eax + 0x3c]
call eax
test eax, eax
jne 0x467686
mov dword [0x7aa688], 1
mov eax, dword [0xc0d848]
test eax, eax
je 0x467692
push eax
call edi
call fcn.00463b40
jmp 0x4676cf
test eax, eax
je 0x4676a2
push 0xffffffffffffffff
push eax
call esi
cmp dword [0x7aa688], 0
je 0x4676c3
mov eax, dword [0x4d9b7c]
test eax, eax
je 0x4676c3
mov eax, dword [eax + 0x40]
mov dword [0x7aa688], 0
call eax
mov eax, dword [0xc0d848]
test eax, eax
je 0x4676cf
push eax
call edi
call fcn.0044bcb0
call fcn.0044c720
test al, al
je 0x467640
mov eax, dword [0xc0d848]
test eax, eax
je 0x4676ef
push 0xffffffffffffffff
push eax
call esi
cmp dword [0x7aa688], 0
je 0x467710
mov eax, dword [0x4d9b7c]
test eax, eax
je 0x467710
mov eax, dword [eax + 0x40]
mov dword [0x7aa688], 0
call eax
mov eax, dword [0xc0d848]
test eax, eax
je 0x46771c
push eax
call edi
mov byte [0x4da79e], 0
mov ecx, dword [esp + 0x13c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.0046ad4d
mov esp, ebp
pop ebp
ret 0x10