Function at 0x4012d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows
Hide graphical window
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xd8
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xd4], eax
push esi
push edi
lea eax, [esp + 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esp + 0x84], 0x1000
jne 0x401889
cmp dword [esp + 0x9c], 0x10000
jne 0x401889
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 1
push 0x2000
push 0x10000000
push 0x30000000
call edi
mov esi, eax
test esi, esi
je 0x40188e
push 4
push 0x1000
push 0x10000
push esi
call edi
lea eax, [esi + 0x1000]
mov dword [0x40a9a8], esi
mov dword [esi + 0xc], eax
lea eax, [esi + 0x2000]
mov dword [esi + 8], eax
lea eax, [esp + 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esp + 0x84], 0x1000
jne 0x401889
cmp dword [esp + 0x9c], 0x10000
jne 0x401889
push 1
push 0x2000
push 0x10000000
push 0x40000000
call edi
test eax, eax
je 0x401898
cmp eax, 0x40000000
jne 0x4018a2
push 4
push 0x1000
push 0x100000
push eax
call edi
mov eax, 0x40000000
mov dword [0x40000008], 0xc
mov dword [0x40000004], eax
mov dword [0x4000000c], 0xefff4
mov dword [0x40000010], 0x10000000
mov dword [eax], 0x68616861
push 0
mov dword [0x40a9a4], eax
mov dword [esp + 0x24], 0x30
mov dword [esp + 0x28], 0x40
mov dword [esp + 0x2c], 0x4010f0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push reloc.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
push 0
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], 0
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0x4071e0
mov dword [esp + 0x50], 0
call dword [sym.imp.USER32.dll_RegisterClassExW]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call esi
push 1
mov dword [0x40a9b0], eax
call esi
push 0
mov dword [0x40a9b4], eax
xorps xmm0, xmm0
push 0xcf0000
lea eax, [esp + 0x58]
push eax
movups xmmword [esp + 0x5c], xmm0
call dword [sym.imp.USER32.dll_AdjustWindowRect]
mov edx, dword [esp + 0x50]
mov eax, 0x38e38e39
sub edx, dword [esp + 0x58]
add edx, dword [0x40a9b0]
mov esi, dword [esp + 0x54]
sub esi, dword [esp + 0x5c]
add esi, dword [0x40a9b4]
mov dword [0x40a998], edx
imul edx
movd xmm0, esi
cvtdq2ps xmm0, xmm0
mov eax, esi
mov dword [0x40a99c], esi
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
movss dword [0x40a994], xmm0
cdq
and edx, 0xf
mov dword [0x40a9b8], ecx
add eax, edx
sar eax, 4
mov dword [0x40a990], eax
call fcn.004018b0
push 0
push dword [esp + 0x38]
push 0
push 0
push dword [0x40a9b4]
push dword [0x40a9b0]
push 0
push 0
push 0xcf0000
push 0x4071e0
push 0x4071e0
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov edi, eax
push 0x20
mov dword [esp + 0x1c], edi
mov dword [0x40a5d8], edi
call dword [sym.imp.d3d9.dll_Direct3DCreate9]
mov esi, eax
mov dword [0x40a5cc], esi
test esi, esi
je 0x401889
push 0x38
lea eax, [esp + 0xa8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0xc4], 1
lea ecx, [esp + 0xa4]
mov dword [esp + 0xbc], 1
mov dword [esp + 0xac], 0
mov eax, dword [esi]
push 0x40a5c8
push ecx
push 0x20
push edi
push 1
push 0
push esi
call dword [eax + 0x40]
test eax, eax
js 0x401889
mov eax, dword [0x40a5c8]
push 3
push 1
push 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x114]
mov eax, dword [0x40a5c8]
push 3
push 2
push 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x114]
mov eax, dword [0x40a5c8]
push 2
push 6
push 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x114]
mov eax, dword [0x40a5c8]
inc dword [0x40a5d0]
push 0
push 0x40a628
mov ecx, dword [eax]
push 1
push 0x16
push 0
push 1
push 0x200
push 0x200
push eax
call dword [ecx + 0x5c]
mov eax, dword [0x40a628]
lea edx, [esp + 0x1c]
push edx
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x50]
push 0
push 0
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x34]
mov esi, dword [esp + 0x54]
xor ecx, ecx
mov edi, 0x409058
mov dword [esp + 0x14], 0x80
xor edx, edx
nop word [eax + eax]
mov dword [esp + 0x10], 0x120
mov dword [esp + 0xc], ecx
test ecx, ecx
jne 0x401677
mov edx, dword [edi]
mov ecx, 0x20
cmp dword [esp + 0xc], 0
lea eax, [edi + 4]
cmovne eax, edi
dec ecx
mov edi, eax
lea eax, [esi + 4]
mov dword [esp + 0xc], eax
mov eax, edx
sar eax, 0x1f
add edx, edx
sub dword [esp + 0x10], 1
mov dword [esi], eax
mov eax, dword [esp + 0xc]
mov esi, eax
jne 0x401668
sub dword [esp + 0x14], 1
lea esi, [eax + 0x380]
jne 0x401660
mov edi, 0x409058
mov dword [esp + 0x10], 0x80
nop dword [eax]
mov dword [esp + 0x14], 0x120
mov dword [esp + 0xc], ecx
test ecx, ecx
jne 0x4016d7
mov edx, dword [edi]
mov ecx, 0x20
cmp dword [esp + 0xc], 0
lea eax, [edi + 4]
cmovne eax, edi
dec ecx
mov edi, eax
lea eax, [esi + 4]
mov dword [esp + 0xc], eax
mov eax, edx
sar eax, 0x1f
add edx, edx
and eax, 1
dec eax
sub dword [esp + 0x14], 1
mov dword [esi], eax
mov eax, dword [esp + 0xc]
mov esi, eax
jne 0x4016c8
sub dword [esp + 0x10], 1
lea esi, [eax + 0x380]
jne 0x4016c0
mov eax, dword [esp + 0x1c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [esp + 0x1c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [0x40a6c4]
mov edx, dword [eax + 0xd4]
mov ecx, dword [eax + 0xdc]
add edx, ecx
call fcn.00401f60
mov esi, dword [esp + 0x18]
push 3
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
xorps xmm0, xmm0
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
movaps xmmword [esp + 0x60], xmm0
movq qword [esp + 0x70], xmm0
mov dword [esp + 0x78], 0
push 1
push 0
push 0
push 0
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x4017ac
call fcn.00401ad0
test al, al
je 0x40179c
lea eax, [esp + 0x60]
push eax
call edi
lea eax, [esp + 0x60]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x401866
cmp byte [0x40a9a0], 0
jne 0x401862
cmp byte [0x40a9a1], 0
jne 0x401862
mov eax, dword [0x40a5c8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
test eax, eax
jne 0x401849
mov eax, dword [0x40a5c8]
push 0
mov byte [0x40a9a0], 1
mov ecx, dword [eax]
push ecx
mov dword [esp], 0x3f800000
push dword [0x40a5d4]
push 1
push 0
push 0
push eax
call dword [ecx + 0xac]
mov eax, dword [0x40a5c8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa4]
mov eax, dword [0x40a5c8]
push 0x104
push eax
mov ecx, dword [eax]
call dword [ecx + 0x164]
call fcn.00403ec0
mov eax, dword [0x40a5c8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa8]
mov eax, dword [0x40a5c8]
push 0
push 0
push 0
mov ecx, dword [eax]
push 0
push eax
call dword [ecx + 0x44]
jmp 0x401866
cmp eax, 0x88760868
jne 0x401856
push 1
call esi
jmp 0x401862
cmp eax, 0x88760869
jne 0x401862
call section..text
push 1
call esi
cmp dword [esp + 0x64], 0x12
jne 0x401775
mov ecx, dword [esp + 0xdc]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00405d2d
mov esp, ebp
pop ebp
ret 0x10
call fcn.00405be0
mov ecx, str.VirtualAlloc_failed
call fcn.00405c70
mov ecx, str.VirtualAlloc_failed
call fcn.00405c70
mov ecx, str.Different_base
call fcn.00405c70
int3