Function at 0x4067f0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
call fcn.00406380
cmp byte [0x48cbf3], 0
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 4], 0
jne 0x4069ef
mov esi, dword [0x48cc28]
mov edx, dword [0x48ccf8]
add esi, 0xfffffff0
add esi, edx
cmp edx, esi
jae 0x406879
nop dword [eax]
xor ecx, ecx
cmp byte [ecx + str.x____xxx_x____xx], 0x78
jne 0x406846
mov al, byte [ecx + 0x43e84c]
cmp al, byte [ecx + edx]
jne 0x406874
inc ecx
cmp ecx, 0x10
jl 0x406832
test edx, edx
je 0x406879
mov eax, dword [edx + 1]
test eax, eax
je 0x406889
lea ecx, [edx + 5]
add ecx, eax
mov dword [ebp - 4], ecx
je 0x406889
lea eax, [ebp - 4]
mov edx, fcn.004040f0
push eax
call fcn.0040b1f0
add esp, 4
jmp 0x406889
inc edx
cmp edx, esi
jb 0x406830
push 0
push str.Error
push str.NGClient_Init__NULL___
push 0
call edi
mov esi, dword [0x48cc28]
mov edx, dword [0x48ccf8]
add esi, 0xfffffff3
add esi, edx
cmp edx, esi
jae 0x4068e9
nop
xor ecx, ecx
cmp byte [ecx + str.x____xxx____x], 0x78
jne 0x4068b6
mov al, byte [ecx + 0x43e88c]
cmp al, byte [ecx + edx]
jne 0x4068e4
inc ecx
cmp ecx, 0xd
jl 0x4068a2
test edx, edx
je 0x4068e9
mov eax, dword [edx + 1]
test eax, eax
je 0x4068f9
lea ecx, [edx + 5]
add ecx, eax
mov dword [ebp - 4], ecx
je 0x4068f9
lea eax, [ebp - 4]
mov edx, fcn.00404100
push eax
call fcn.0040b1f0
add esp, 4
jmp 0x4068f9
inc edx
cmp edx, esi
jb 0x4068a0
push 0
push str.Error
push str.NGClient_Quit__NULL___
push 0
call edi
mov edx, dword [0x48cc28]
mov esi, dword [0x48ccf8]
add edx, 0xffffffef
add edx, esi
cmp esi, edx
jae 0x406980
nop
xor ecx, ecx
cmp byte [ecx + str.x____x____x_xxxxx], 0x78
jne 0x406926
mov al, byte [ecx + 0x43e8cc]
cmp al, byte [ecx + esi]
jne 0x40697b
inc ecx
cmp ecx, 0x11
jl 0x406912
test esi, esi
je 0x406980
mov eax, dword [esi + 1]
test eax, eax
je 0x406952
lea ecx, [esi + 5]
add ecx, eax
mov dword [ebp - 4], ecx
je 0x406952
lea eax, [ebp - 4]
mov edx, fcn.00404100
push eax
call fcn.0040b1f0
add esp, 4
add esi, 5
je 0x406990
mov eax, dword [esi + 1]
test eax, eax
je 0x406990
lea ecx, [esi + 5]
add ecx, eax
mov dword [ebp - 4], ecx
je 0x406990
lea eax, [ebp - 4]
mov edx, fcn.004040f0
push eax
call fcn.0040b1f0
add esp, 4
jmp 0x406990
inc esi
cmp esi, edx
jb 0x406910
push 0
push str.Error
push str.Packet_Hack_Send__NULL___
push 0
call edi
mov edx, dword [0x48cc28]
mov esi, dword [0x48ccf8]
add edx, 0xffffff9b
add edx, esi
cmp esi, edx
jae 0x4069df
xor ecx, ecx
cmp byte [ecx + str.xxxx_x____xx____xxx_xxxx____xxxxx_xx____xxxx_xx_xx_xx_xx_____xx_____xx_x_xx_xx_____xxx_x____xxx_xx_xx], 0x78
jne 0x4069bb
mov al, byte [ecx + 0x43e968]
cmp al, byte [ecx + esi]
jne 0x4069da
inc ecx
cmp ecx, 0x65
jl 0x4069a7
test esi, esi
je 0x4069df
lea eax, [ebp - 4]
mov edx, 0x405900
push eax
mov ecx, esi
call fcn.0040b1f0
add esp, 4
jmp 0x4069ef
inc esi
cmp esi, edx
jb 0x4069a5
push 0
push str.Error
push str.Packet_Hack_Parse__NULL___
push 0
call edi
lea eax, [ebp - 4]
push eax
push 0x404110
push str.InitializeGameLogManagerA
call fcn.0040b3a0
add esp, 0xc
lea eax, [ebp - 4]
push eax
push fcn.00404100
push str.WriteStageLogA
call fcn.0040b3a0
add esp, 0xc
lea eax, [ebp - 4]
push eax
push fcn.00404100
push str.WriteErrorLogA
call fcn.0040b3a0
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x404110
push str.FinalizeGameLogManager
call fcn.0040b3a0
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x404110
push str.SetUserSN
call fcn.0040b3a0
add esp, 0xc
cmp byte [0x48cc6e], 0
jne 0x406e0b
mov esi, dword [0x48cc28]
mov edx, dword [0x48ccf8]
add esi, 0xfffffff1
add esi, edx
cmp edx, esi
jae 0x406ac7
nop
xor ecx, ecx
cmp byte [ecx + str.x____x_xxx____x], 0x78
jne 0x406a96
mov al, byte [ecx + 0x43ea6c]
cmp al, byte [ecx + edx]
jne 0x406ac2
inc ecx
cmp ecx, 0xf
jl 0x406a82
test edx, edx
je 0x406ac7
mov eax, dword [edx + 1]
test eax, eax
je 0x406ad7
lea ecx, [edx + 5]
add ecx, eax
je 0x406ad7
push 0x48cd08
mov edx, 0x404130
call fcn.0040b1f0
add esp, 4
jmp 0x406ad7
inc edx
cmp edx, esi
jb 0x406a80
push 0
push str.Error
push str.SocketManagerConstructor__NULL___
push 0
call edi
mov ebx, dword [0x48cc28]
mov esi, dword [0x48ccf8]
add ebx, 0xfffffff6
add ebx, esi
cmp esi, ebx
jae 0x406bc0
mov edi, esi
neg edi
xor edx, edx
mov ecx, esi
nop dword [eax + eax]
cmp byte [edi + ecx + str.x____xxx_x], 0x78
jne 0x406b19
mov al, byte [edi + ecx + 0x43eaac]
cmp al, byte [ecx]
jne 0x406bb0
inc edx
inc ecx
cmp edx, 0xa
jl 0x406b00
test esi, esi
je 0x406bba
mov eax, dword [esi + 1]
test eax, eax
je 0x406b48
lea ecx, [esi + 5]
add ecx, eax
je 0x406b48
push 0x48cc44
mov edx, 0x404150
call fcn.0040b1f0
add esp, 4
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, dword [0x48cc28]
mov esi, dword [0x48ccf8]
add ebx, 0xfffffff6
add ebx, esi
cmp esi, ebx
jae 0x406be1
mov edi, esi
neg edi
nop word [eax + eax]
xor edx, edx
mov ecx, esi
cmp byte [edi + ecx + str.xxxx____xx], 0x78
jne 0x406b89
mov al, byte [edi + ecx + 0x43eae0]
cmp al, byte [ecx]
jne 0x406bd5
inc edx
inc ecx
cmp edx, 0xa
jl 0x406b74
test esi, esi
je 0x406bdb
push 0x48cc30
mov edx, 0x404190
mov ecx, esi
call fcn.0040b1f0
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
add esp, 4
jmp 0x406bf1
inc esi
dec edi
cmp esi, ebx
jb 0x406af4
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push str.Error
push str.ServerConnect__NULL___
push 0
call edi
jmp 0x406b4e
inc esi
dec edi
cmp esi, ebx
jb 0x406b70
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push str.Error
push str.HolePunch__SetServerInfo__NULL___
push 0
call edi
mov edx, dword [0x48cc28]
mov esi, dword [0x48ccf8]
add edx, 0xfffffff0
add edx, esi
cmp esi, edx
jae 0x406c4b
nop word [eax + eax]
xor ecx, ecx
cmp byte [ecx + str.xxxxx_xxx_xxx_xx], 0x78
jne 0x406c26
mov al, byte [ecx + 0x43eb24]
cmp al, byte [ecx + esi]
jne 0x406c46
inc ecx
cmp ecx, 0x10
jl 0x406c12
test esi, esi
je 0x406c4b
push 0x48cc14
mov edx, 0x4060a0
mov ecx, esi
call fcn.0040b1f0
add esp, 4
jmp 0x406c5b
inc esi
cmp esi, edx
jb 0x406c10
push 0
push str.Error
push str.HolePunch__GetUserSocketInfo__NULL___
push 0
call edi
mov ecx, dword [0x48ccf8]
mov edx, dword [0x48cc28]
push 1
push str.resource_zombi_ZombieSkillProperty_Dedi_ZombieSkillProperty_Crazy.csv
lea edx, [edx + ecx]
call fcn.0040b530
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 8
mov dword [ebp - 0x18], 0x90909090
mov dword [ebp - 0x14], 0x53909090
lea esi, [eax - 0x2d]
mov dword [ebp - 0x10], 0x9090d98b
push 0x48ce14
push 0x40
push 0x10
push esi
mov dword [ebp - 0xc], 0x90909090
call ebx
test eax, eax
je 0x406cc5
movups xmm0, xmmword [ebp - 0x18]
push 0x48ce14
movups xmmword [esi], xmm0
push dword [0x48ce14]
push 0x10
push esi
call ebx
mov ecx, dword [0x48ccf8]
mov edx, dword [0x48cc28]
push 1
push str.resource_zombi_FireBombOption_Dedi.csv
lea edx, [edx + ecx]
call fcn.0040b530
add esp, 8
mov dword [ebp - 0x18], 0x90909090
mov dword [ebp - 0x14], 0x8b909090
mov dword [ebp - 0x10], 0xd87589f0
lea esi, [eax - 0x14]
mov dword [ebp - 0xc], 0x90909090
push 0x48ce14
push 0x40
push 0x12
push esi
mov word [ebp - 8], 0x9090
call ebx
test eax, eax
je 0x406d37
movups xmm0, xmmword [ebp - 0x18]
mov ax, word [ebp - 8]
push 0x48ce14
movups xmmword [esi], xmm0
mov word [esi + 0x10], ax
push dword [0x48ce14]
push 0x12
push esi
call ebx
mov edx, dword [0x48cc28]
mov esi, dword [0x48ccf8]
add edx, 0xfffffff7
add edx, esi
cmp esi, edx
jae 0x406d8b
nop dword [eax]
xor ecx, ecx
cmp byte [ecx + str.xxxxxxxxx], 0x78
jne 0x406d66
mov al, byte [ecx + 0x43eb6c]
cmp al, byte [ecx + esi]
jne 0x406d86
inc ecx
cmp ecx, 9
jl 0x406d52
test esi, esi
je 0x406d8d
push 0x48cc5c
mov edx, 0x404550
mov ecx, esi
call fcn.0040b1f0
add esp, 4
jmp 0x406d9d
inc esi
cmp esi, edx
jb 0x406d50
xor esi, esi
push 0
push str.Error
push str.CreateStringTable__NULL___
push 0
call edi
mov eax, dword [esi + 0x72]
add esi, 0x76
mov edx, dword [0x48cc28]
add eax, esi
mov esi, dword [0x48ccf8]
add edx, 0xfffffff3
add edx, esi
mov dword [0x48cbec], eax
cmp esi, edx
jae 0x406dfb
nop
xor ecx, ecx
cmp byte [ecx + str.xxxxx____xxxx], 0x78
jne 0x406dd6
mov al, byte [ecx + 0x43eba8]
cmp al, byte [ecx + esi]
jne 0x406df6
inc ecx
cmp ecx, 0xd
jl 0x406dc2
test esi, esi
je 0x406dfb
push 0x48cc1c
mov edx, 0x404d40
mov ecx, esi
call fcn.0040b1f0
add esp, 4
jmp 0x406e0b
inc esi
cmp esi, edx
jb 0x406dc0
push 0
push str.Error
push str.LoadJson__NULL___
push 0
call edi
mov ebx, dword [0x48cc28]
mov esi, dword [0x48ccf8]
add ebx, 0xffffffbe
add ebx, esi
cmp esi, ebx
jae 0x406e72
mov edi, esi
neg edi
xor edx, edx
mov ecx, esi
nop dword [eax + eax]
cmp byte [edi + ecx + str.xxxxx____x____xxxx_xxx_xx_xx_xx_xx____x____xx____xxxx_xx_xxx____xx], 0x78
jne 0x406e45
mov al, byte [edi + ecx + 0x43ec18]
cmp al, byte [ecx]
jne 0x406e6c
inc edx
inc ecx
cmp edx, 0x42
jl 0x406e30
test esi, esi
je 0x406e72
push 0x48cc4c
mov edx, 0x406010
mov ecx, esi
call fcn.0040b1f0
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
add esp, 4
jmp 0x406e88
inc esi
dec edi
cmp esi, ebx
jb 0x406e24
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push str.Error
push str.LogToErrorLog__NULL___
push 0
call esi
mov ecx, dword [0x48ccf8]
mov edx, dword [0x48cc28]
push 1
push str.ScreenFade
lea edx, [edx + ecx]
call fcn.0040b530
add esp, 8
mov eax, dword [eax + 0xd]
mov dword [0x48ccfc], eax
test eax, eax
jne 0x406ec5
push eax
push str.Error
push str.g_pEngine__NULL___
push eax
call esi
mov eax, dword [0x48ccfc]
cmp byte [0x48cc6c], 0
mov dword [eax + 0x29c], 0x404120
jne 0x406eea
cmp byte [0x48cc23], 0
jne 0x406eea
cmp byte [0x48cc20], 0
je 0x406f48
mov ebx, dword [0x48cc28]
mov esi, dword [0x48ccf8]
add ebx, 0xffffff87
add ebx, esi
cmp esi, ebx
jae 0x406fb0
mov edi, esi
neg edi
nop word [eax + eax]
xor edx, edx
mov ecx, esi
cmp byte [edi + ecx + str.xxxx_x____xx____xxx____x____xxxx_xxxxx_xx____xxxx____xx_xxxx____xx____xx_xx________xx____xx____x_xx____xx_xxx____x____xxx], 0x78
jne 0x406f29
mov al, byte [edi + ecx + 0x43ed20]
cmp al, byte [ecx]
jne 0x406fa6
inc edx
inc ecx
cmp edx, 0x79
jl 0x406f14
test esi, esi
je 0x406fb0
push 0x48ccf4
mov edx, 0x404f80
mov ecx, esi
call fcn.0040b1f0
add esp, 4
mov ebx, dword [sym.imp.USER32.dll_MessageBoxA]
cmp byte [0x48cc6d], 0
je 0x406fdd
mov edx, dword [0x48cc28]
mov esi, dword [0x48ccf8]
add edx, 0xffffff97
add edx, esi
cmp esi, edx
jae 0x406fcd
xor ecx, ecx
cmp byte [ecx + str.xxxx_x____xx____xxx_xxxx____xxxxx_xx____xxxx_xx_xx_xx_____xx_____xx_x_xx_xx_____xxx_x____xxx_xx_x____xx_x], 0x78
jne 0x406f86
mov al, byte [ecx + 0x43ee30]
cmp al, byte [ecx + esi]
jne 0x406fc8
inc ecx
cmp ecx, 0x69
jl 0x406f72
test esi, esi
je 0x406fcd
push 0x48cc0c
mov edx, 0x405810
mov ecx, esi
call fcn.0040b1f0
add esp, 4
jmp 0x406fdd
inc esi
dec edi
cmp esi, ebx
jb 0x406f10
mov ebx, dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push str.Error
push str.Packet_Metadata_Parse__NULL___
push 0
call ebx
jmp 0x406f4e
inc esi
cmp esi, edx
jb 0x406f70
push 0
push str.Error
push str.Packet_Quest_Parse__NULL___
push 0
call ebx
cmp byte [0x48cc3a], 0
je 0x40704b
mov edx, dword [0x48cc28]
mov esi, dword [0x48ccf8]
add edx, 0xffffffcb
add edx, esi
cmp esi, edx
jae 0x40703b
nop dword [eax + eax]
xor ecx, ecx
cmp byte [ecx + str.xxxx_x____xx____xx____x____x____xxxx_xxxxx_xx____xxxx], 0x78
jne 0x407016
mov al, byte [ecx + 0x43eef4]
cmp al, byte [ecx + esi]
jne 0x407036
inc ecx
cmp ecx, 0x35
jl 0x407002
test esi, esi
je 0x40703b
push 0x48cbf4
mov edx, 0x405840
mov ecx, esi
call fcn.0040b1f0
add esp, 4
jmp 0x40704b
inc esi
cmp esi, edx
jb 0x407000
push 0
push str.Error
push str.Packet_UMsg_Parse__NULL___
push 0
call ebx
cmp byte [0x48cc21], 0
je 0x4070be
mov edx, dword [0x48cc28]
mov esi, dword [0x48ccf8]
add edx, 0xffffff77
add edx, esi
cmp esi, edx
jae 0x4070ae
nop dword [eax]
xor ecx, ecx
cmp byte [ecx + str.xxxx_x____xx____xxx____x____xxxx_xxxxx_xx____xxxx____xx_xx________xx____xx_xx________xx________xx____x_xx____xx_____xxx____x____xxx____xx], 0x78
jne 0x407086
mov al, byte [ecx + 0x43efe0]
cmp al, byte [ecx + esi]
jne 0x4070a9
inc ecx
cmp ecx, 0x89
jl 0x407072
test esi, esi
je 0x4070ae
push 0x48cc24
mov edx, 0x405870
mov ecx, esi
call fcn.0040b1f0
add esp, 4
jmp 0x4070be
inc esi
cmp esi, edx
jb 0x407070
push 0
push str.Error
push str.Packet_Alarm_Parse__NULL___
push 0
call ebx
cmp byte [0x48cbf2], 0
je 0x40712b
mov edx, dword [0x48cc28]
mov esi, dword [0x48ccf8]
add edx, 0xffffffcc
add edx, esi
cmp esi, edx
jae 0x40711b
nop dword [eax]
xor ecx, ecx
cmp byte [ecx + str.xxxx_x____xx____xxx____x____xxxx_xxxxx_xx____xxxx_xx], 0x78
jne 0x4070f6
mov al, byte [ecx + 0x43f0c4]
cmp al, byte [ecx + esi]
jne 0x407116
inc ecx
cmp ecx, 0x34
jl 0x4070e2
test esi, esi
je 0x40711b
push 0x48cc68
mov edx, 0x4058a0
mov ecx, esi
call fcn.0040b1f0
add esp, 4
jmp 0x40712b
inc esi
cmp esi, edx
jb 0x4070e0
push 0
push str.Error
push str.Packet_Item_Parse__NULL___
push 0
call ebx
cmp byte [0x48cc3b], 0
je 0x40719b
mov edx, dword [0x48cc28]
mov esi, dword [0x48ccf8]
add edx, 0xffffff8a
add edx, esi
cmp esi, edx
jae 0x40718b
nop dword [eax]
xor ecx, ecx
cmp byte [ecx + str.xxxxxx____xx____xxx____x____xxxxxxxxxxxxxx____xxxxx____xxxxx________xx________xx____xxxx____xx_____xxx____x____xxx____], 0x78
jne 0x407166
mov al, byte [ecx + 0x43f198]
cmp al, byte [ecx + esi]
jne 0x407186
inc ecx
cmp ecx, 0x76
jl 0x407152
test esi, esi
je 0x40718b
push 0x48cbd4
mov edx, 0x4058d0
mov ecx, esi
call fcn.0040b1f0
add esp, 4
jmp 0x40719b
inc esi
cmp esi, edx
jb 0x407150
push 0
push str.Error
push str.Packet_Crypt_Parse__NULL___
push 0
call ebx
cmp byte [0x48cc38], 0
je 0x407200
mov ecx, dword [0x48ccf8]
mov edx, dword [0x48cc28]
push 1
push str.SocketManager___Initial_ReadPacket___failed.__return___d__n
lea edx, [edx + ecx]
call fcn.0040b530
sub eax, 0x10
add esp, 8
cmp eax, 0xfffffff0
jne 0x4071dc
push 0
push str.Error
push str.dwCallAddr__0___
push 0
call ebx
jmp 0x407200
test eax, eax
je 0x407200
mov ecx, dword [eax + 1]
test ecx, ecx
je 0x407200
add ecx, 5
add ecx, eax
je 0x407200
push 0x48cbfc
mov edx, 0x405ed0
call fcn.0040b1f0
add esp, 4
mov eax, dword [0x48cc28]
mov edi, 1
mov esi, dword [0x48ccf8]
add eax, 0xffffffee
add eax, esi
cmp esi, eax
jae 0x4072a4
mov edx, esi
sub edx, str.cstrike_online.exe
nop word [eax + eax]
xor ecx, ecx
nop dword [eax]
nop word [eax + eax]
mov al, byte [ecx + str.cstrike_online.exe]
cmp al, byte [ecx + edx + str.cstrike_online.exe]
jne 0x40725a
inc ecx
cmp ecx, 0x12
jb 0x407240
sub edi, 1
je 0x407270
mov eax, dword [0x48cc28]
inc esi
add eax, 0xffffffee
inc edx
add eax, dword [0x48ccf8]
cmp esi, eax
jb 0x407230
jmp 0x4072a4
test esi, esi
je 0x4072a4
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x48ce14
push 0x40
push 0x10
push esi
call edi
test eax, eax
je 0x4072a4
movups xmm0, xmmword [0x43f294]
push 0x48ce14
movups xmmword [esi], xmm0
push dword [0x48ce14]
push 0x10
push esi
call edi
cmp byte [0x48cc6e], 0
jne 0x40737b
mov ecx, dword [0x48ccf8]
mov edx, dword [0x48cc28]
push 1
push str.CRYPT_ERROR
lea edx, [edx + ecx]
call fcn.0040b530
add esp, 8
test eax, eax
je 0x4072fa
sub eax, 0x117
je 0x4072fa
mov ecx, dword [eax + 1]
test ecx, ecx
je 0x4072fa
add ecx, 5
add ecx, eax
je 0x4072fa
push 0x48cc04
mov edx, 0x405e70
call fcn.0040b1f0
add esp, 4
cmp byte [0x48cc6f], 0
jne 0x40737b
mov ecx, dword [0x48ccf8]
mov edx, dword [0x48cc28]
push 1
push str.new_socket____
lea edx, [edx + ecx]
call fcn.0040b530
add esp, 8
test eax, eax
je 0x40737b
add eax, 0x62
je 0x40734a
mov ecx, dword [eax + 1]
test ecx, ecx
je 0x40734a
add ecx, 5
add ecx, eax
je 0x40734a
push 0x48cd04
mov edx, 0x405e90
call fcn.0040b1f0
add esp, 4
mov ecx, dword [0x48ccf8]
mov edx, dword [0x48cc28]
push 2
push str.SSL:_Failed_to_load_Clients_Private_Key
lea edx, [edx + ecx]
call fcn.0040b530
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x40737b
mov eax, dword [ecx - 0x1e]
add eax, 0xffffffe6
add eax, ecx
mov dword [0x48cc40], eax
push 0
push 0
push 0
push 0x4060f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret