Function at 0x402970
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x40fa93
mov eax, dword fs:[0]
push eax
sub esp, 0x970
mov eax, dword [0x41901c]
xor eax, esp
mov dword [esp + 0x968], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x41901c]
xor eax, esp
push eax
lea eax, [esp + 0x984]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x994]
mov esi, dword [ebp + 8]
cmp dword [ebp + 4], esi
mov dword [esp + 0x40], ebp
mov ebx, ecx
jbe 0x4029c6
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov edi, dword [ebp + 4]
cmp edi, dword [ebp + 8]
jbe 0x4029d4
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
push esi
push ebp
push edi
push ebp
lea eax, [esp + 0x5c]
push eax
push ebp
call fcn.00405930
push 0
push 0
push 0x1004
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esp + 0x58]
push ecx
push ebx
mov dword [esp + 0x44], eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [esp + 0x58]
push edx
push 0
push 0x438
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 4
push 0x1000
push 0x40
mov edi, eax
push 0
push edi
call esi
push 4
push 0x1000
push 0x200
push 0
push edi
mov dword [esp + 0x2c], eax
call esi
push 4
push 0x1000
push 0x200
push 0
push edi
mov dword [esp + 0x34], eax
call esi
push 4
push 0x1000
push 0x10
push 0
push edi
mov dword [esp + 0x38], eax
mov dword [esp + 0xb0], 0x200
mov dword [esp + 0x70], 1
call esi
push 4
push 0x1000
push 8
push 0
push edi
mov dword [esp + 0x30], eax
call esi
mov dword [esp + 0x28], eax
xor eax, eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x98c], eax
lea eax, [esp + 0xf4]
push eax
call sub.K8Common.dll_public:_static_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_GameMgr::GMShellUtils::GetCUDesktopDirectory_void_
add esp, 4
push eax
lea esi, [esp + 0x30]
mov byte [esp + 0x990], 1
call fcn.004055b0
lea ecx, [esp + 0xf4]
mov byte [esp + 0x98c], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0xf4]
push ecx
call sub.K8Common.dll_public:_static_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_GameMgr::GMShellUtils::GetAUDesktopDirectory_void_
add esp, 4
push eax
mov byte [esp + 0x990], 2
call fcn.004055b0
lea ecx, [esp + 0xf4]
mov byte [esp + 0x98c], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov esi, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
cmp esi, eax
jbe 0x402b25
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x30], eax
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], eax
jbe 0x402b3d
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov eax, dword [esp + 0x34]
cmp esi, dword [esp + 0x54]
je 0x402ed8
cmp esi, eax
jb 0x402b51
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
push esi
lea ecx, [esp + 0xf8]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
xor ebp, ebp
cmp dword [esp + 0x3c], ebp
mov byte [esp + 0x98c], 3
jle 0x402ea5
mov eax, dword [esp + 0x20]
cdq
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x70], edx
cdq
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], edx
mov edx, dword [esp + 0x6c]
mov eax, dword [esp + 0x70]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0x40
lea ecx, [esp + 0x84]
mov dword [esp + 0x9c], edx
mov edx, dword [esp + 0x20]
push ecx
push edx
push edi
mov dword [esp + 0x98], 0
mov dword [esp + 0xac], eax
call esi
mov eax, dword [esp + 0x18]
push eax
push ebp
push 0x1073
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
push 0
push 0x40
lea eax, [esp + 0x84]
mov dword [esp + 0x9c], ecx
mov ecx, dword [esp + 0x20]
push eax
push ecx
push edi
mov dword [esp + 0x98], 1
mov dword [esp + 0xac], edx
call esi
mov edx, dword [esp + 0x18]
push edx
push ebp
push 0x1073
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x1c]
push 0
push 0x10
lea eax, [esp + 0x64]
push eax
push ecx
push edi
mov dword [esp + 0x70], 1
call esi
mov edx, dword [esp + 0x1c]
push edx
push ebp
push 0x100e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x28]
push 0
push 8
lea eax, [esp + 0x7c]
push eax
push ecx
push edi
call esi
mov edx, dword [esp + 0x28]
push edx
push ebp
push 0x1010
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 0x200
lea eax, [esp + 0x184]
push eax
push ecx
push edi
call esi
push 0
push 0x200
lea edx, [esp + 0x584]
push edx
mov eax, dword [esp + 0x30]
push eax
push edi
call esi
mov edx, dword [esp + 0x1c]
push 0
push 0x10
lea ecx, [esp + 0x64]
push ecx
push edx
push edi
call esi
mov ecx, dword [esp + 0x28]
push 0
push 8
lea eax, [esp + 0x7c]
push eax
push ecx
push edi
call esi
lea edx, [esp + 0x17c]
push edx
lea ecx, [esp + 0xc0]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
lea eax, [esp + 0xbc]
push eax
lea ecx, [esp + 0xf8]
push ecx
lea edx, [esp + 0xe0]
push edx
mov byte [esp + 0x998], 4
call sub.K8Common.dll_public:_static_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_GameMgr::GMFileName::JoinFileName_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__
add esp, 0xc
lea ecx, [esp + 0xbc]
mov byte [esp + 0x98c], 6
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
push str..lnk
lea ecx, [esp + 0xdc]
call dword [0x4113b4]
lea eax, [esp + 0xd8]
push eax
call sub.K8Common.dll_public:_static_bool___cdecl_GameMgr::GMFilePathUtils::IsExistsFile_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__
add esp, 4
test al, al
je 0x402e7f
lea ecx, [esp + 0x110]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea ecx, [esp + 0x17]
mov byte [esp + 0x98c], 7
call sub.K8Common.dll_public:_void___thiscall_GameMgr::GMQuickLaunch::constructor_void_
lea ecx, [esp + 0x110]
push ecx
lea edx, [esp + 0xdc]
push edx
lea ecx, [esp + 0x1f]
mov byte [esp + 0x994], 8
call sub.K8Common.dll_public:_bool___thiscall_GameMgr::GMQuickLaunch::ParseLinkFile_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t____
test al, al
je 0x402e59
lea ecx, [esp + 0x12c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea ecx, [esp + 0x160]
mov byte [esp + 0x98c], 9
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea eax, [esp + 0x110]
push eax
lea ecx, [esp + 0x130]
mov byte [esp + 0x990], 0xa
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x78]
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x148], ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x154], ecx
lea ecx, [esp + 0x17c]
mov dword [esp + 0x14c], edx
mov edx, dword [esp + 0x64]
mov dword [esp + 0x150], eax
mov eax, dword [esp + 0x68]
push ecx
lea ecx, [esp + 0x164]
mov dword [esp + 0x15c], edx
mov dword [esp + 0x160], eax
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
mov esi, dword [esp + 0x40]
lea edx, [esp + 0x12c]
push edx
call fcn.004056a0
lea ecx, [esp + 0x160]
mov byte [esp + 0x98c], 0xb
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x12c]
mov byte [esp + 0x98c], 8
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x17]
mov byte [esp + 0x98c], 7
call sub.K8Common.dll_public:_void___thiscall_GameMgr::GMQuickLaunch::destructor_void_
lea ecx, [esp + 0x110]
mov byte [esp + 0x98c], 6
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0xd8]
mov byte [esp + 0x98c], 3
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
add ebp, 1
cmp ebp, dword [esp + 0x3c]
jl 0x402b8d
mov esi, dword [esp + 0x50]
lea ecx, [esp + 0xf4]
mov byte [esp + 0x98c], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, dword [esp + 0x34]
cmp esi, eax
jb 0x402ecc
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov eax, dword [esp + 0x34]
mov ebp, dword [esp + 0x40]
add esi, 0x1c
jmp 0x402b25
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
push eax
push edi
call esi
mov ecx, dword [esp + 0x20]
push 0x8000
push 0
push ecx
push edi
call esi
mov edx, dword [esp + 0x24]
push 0x8000
push 0
push edx
push edi
call esi
mov eax, dword [esp + 0x1c]
push 0x8000
push 0
push eax
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 4]
test eax, eax
je 0x402f3e
mov ebp, dword [ebp + 8]
sub ebp, eax
mov eax, 0x66666667
imul ebp
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
test eax, eax
mov dword [esp + 0x98c], 0xffffffff
mov esi, dword [esp + 0x30]
setne bl
test esi, esi
je 0x402f7c
mov edi, dword [esp + 0x34]
cmp esi, edi
je 0x402f73
mov edi, edi
mov ecx, esi
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
add esi, 0x1c
cmp esi, edi
jne 0x402f60
mov esi, dword [esp + 0x30]
push esi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x984]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x968]
xor ecx, esp
call fcn.0040e0e6
add esp, 0x97c
ret