Function at 0x406ae0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x168
mov eax, dword [0x422004]
xor eax, esp
mov dword [esp + 0x164], eax
push esi
mov esi, edx
push edi
cmp ecx, 2
jle 0x406ff6
push 0x41d8d0
call fcn.00401530
mov eax, dword [esi + 8]
add esp, 4
mov edx, 0x41d8e0
mov ecx, eax
nop
mov si, word [ecx]
cmp si, word [edx]
jne 0x406b46
test si, si
je 0x406b42
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x406b46
add ecx, 4
add edx, 4
test si, si
jne 0x406b20
xor ecx, ecx
jmp 0x406b4b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x406bff
mov al, byte [0x41d608]
movq xmm0, qword [0x41d600]
push 0x37
mov byte [esp + 0x34], al
lea eax, [esp + 0x35]
push ecx
push eax
movq qword [esp + 0x34], xmm0
call sub.VCRUNTIME140.dll_memset
push pe_nt_image_headers32
lea eax, [esp + 0x78]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
lea edi, [esp + 0x68]
xor esi, esi
movzx eax, byte [esp + esi + 0x28]
push eax
push 0x41b468
push 0xffffffffffffffff
push 3
push edi
call fcn.00401570
inc esi
add esp, 0x14
add edi, 2
cmp esi, 0x40
jb 0x406b91
lea eax, [esp + 0x68]
push eax
push 0x41d60c
call fcn.00401530
push 0xfffffffffffffffb
push 0x41d610
call fcn.00401530
push 0xfb
push 0x41d610
call fcn.00401530
push 0xfffffffffffffffb
push 0x41d618
call fcn.00401530
push 0xfb
push 0x41d618
call fcn.00401530
add esp, 0x28
jmp 0x406fe9
mov edx, 0x41d8f0
mov ecx, eax
mov si, word [ecx]
cmp si, word [edx]
jne 0x406c2c
test si, si
je 0x406c28
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x406c2c
add ecx, 4
add edx, 4
test si, si
jne 0x406c06
xor ecx, ecx
jmp 0x406c31
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x406de4
push ecx
push 0x18
push 0x41d61c
call fcn.00401530
push 0
push 0x41d638
call fcn.00401530
push 4
push 0x41d644
call fcn.00401530
push 8
push 0x41d658
call fcn.00401530
push 0xc
push 0x41d668
call fcn.00401530
push 0x10
push 0x41d678
call fcn.00401530
push 0x14
push 0x41d690
call fcn.00401530
push 0
push 0x30
push 0x41d6b0
call fcn.00401530
add esp, 0x48
push 0
push 0x41d638
call fcn.00401530
push 8
push 0x41d644
call fcn.00401530
push 0x10
push 0x41d658
call fcn.00401530
push 0x18
push 0x41d668
call fcn.00401530
push 0x20
push 0x41d678
call fcn.00401530
push 0x28
push 0x41d690
call fcn.00401530
push 0
push 0x18
push 0x41d6cc
call fcn.00401530
push 0
push 0x41d638
call fcn.00401530
add esp, 0x44
push 4
push 0x41d644
call fcn.00401530
push 8
push 0x41d658
call fcn.00401530
push 0xc
push 0x41d668
call fcn.00401530
push 0x10
push 0x41d678
call fcn.00401530
push 0x14
push 0x41d690
call fcn.00401530
push 0
push 8
push 0x41d6e4
call fcn.00401530
push 0
push 0x41d638
call fcn.00401530
push 2
push 0x41d6fc
call fcn.00401530
add esp, 0x44
push 4
push 0x41d710
call fcn.00401530
push 0
push 0x10
push 0x41d71c
call fcn.00401530
push 0
push 0x41d638
call fcn.00401530
push 2
push 0x41d6fc
call fcn.00401530
push 8
push 0x41d710
call fcn.00401530
push 0
push 8
push 0x41d734
call fcn.00401530
push 0
push 0x41d638
call fcn.00401530
add esp, 0x40
push 2
push 0x41d6fc
call fcn.00401530
push 4
push 0x41d710
call fcn.00401530
add esp, 0x10
jmp 0x406fe9
mov edx, 0x41d900
mov ecx, eax
nop dword [eax + eax]
mov si, word [ecx]
cmp si, word [edx]
jne 0x406e16
test si, si
je 0x406e12
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x406e16
add ecx, 4
add edx, 4
test si, si
jne 0x406df0
xor ecx, ecx
jmp 0x406e1b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x406ef7
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x41d74c
call edi
push eax
push str.minidbg.exe:_p_n
call fcn.00401530
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
add esp, 8
push str.minidbg.exe
call esi
push eax
push str.minidbg.exe:_p_n
call fcn.00401530
add esp, 8
push 0x41b7df
call edi
push eax
push 0x41d780
call fcn.00401530
add esp, 8
push 0
call edi
push eax
push 0x41d780
call fcn.00401530
add esp, 8
push 0
call esi
push eax
push 0x41d780
call fcn.00401530
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 8
push 0x41d784
call edi
push eax
push 0x41d7a0
call fcn.00401530
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
add esp, 8
push 0x41d7b4
call esi
push eax
push 0x41d7a0
call fcn.00401530
add esp, 8
push 0x41d7ec
call edi
push eax
push 0x41d80c
call fcn.00401530
add esp, 8
push 0x41d820
call esi
push eax
push 0x41d80c
call fcn.00401530
add esp, 8
jmp 0x406fe9
mov edx, 0x41d910
mov ecx, eax
nop
mov si, word [ecx]
cmp si, word [edx]
jne 0x406f26
test si, si
je 0x406f22
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x406f26
add ecx, 4
add edx, 4
test si, si
jne 0x406f00
xor ecx, ecx
jmp 0x406f2b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x406f55
push 0x10
push ecx
push 0x41d85c
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
push eax
push 0x41d85c
push 0x41d86c
call fcn.004014f0
add esp, 0x18
jmp 0x406fe9
mov ecx, 0x41d918
nop word [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x406f86
test dx, dx
je 0x406f82
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x406f86
add eax, 4
add ecx, 4
test dx, dx
jne 0x406f60
xor eax, eax
jmp 0x406f8b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x406fe9
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x40
push 0x3000
push 0x1024
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0x1c
lea edi, [eax + 5]
lea eax, [esp + 0x10]
push eax
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push edi
push 0x41d880
call fcn.00401530
add esp, 0x24
push 0x41d920
call fcn.00401530
add esp, 4
mov ecx, dword [esp + 0x16c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00419265
mov esp, ebp
pop ebp
ret