Function at 0x402006
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Parse pe header

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x2e8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp + 0x6c], eax
mov eax, dword [ebp + 0x78]
and dword [ebp - 0x274], 0
push ebx
push esi
push edi
mov esi, 0x150
push esi
mov dword [ebp - 0x270], eax
lea eax, [ebp - 0x244]
mov edi, ecx
push 0
push eax
mov dword [ebp - 0x248], edi
call sub.MSVCR110.dll_memset
push edi
mov dword [ebp - 0x244], esi
call fcn.00401c9c
mov ebx, eax
push 0x40
lea eax, [ebp + 4]
push 0
push eax
mov dword [ebp - 0x258], ebx
call sub.MSVCR110.dll_memset
add esp, 0x1c
push 0
push 0x40
lea eax, [ebp + 4]
push eax
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call edi
test eax, eax
je 0x40262c
push 0x40
lea eax, [ebp + 4]
push eax
lea eax, [ebp - 0x230]
push eax
call sub.MSVCR110.dll_memcpy
mov eax, 0x5a4d
add esp, 0xc
mov dword [ebp - 0x240], ebx
cmp word [ebp + 4], ax
jne 0x40262c
add esi, 0xffffffa8
push esi
lea eax, [ebp - 0xf4]
push 0
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
push 0
push esi
lea eax, [ebp - 0xf4]
push eax
mov eax, dword [ebp + 0x40]
add eax, ebx
push eax
push dword [ebp - 0x248]
call edi
test eax, eax
je 0x40262c
push esi
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0x1f0]
push eax
call sub.MSVCR110.dll_memcpy
mov eax, dword [ebp + 0x40]
add esp, 0xc
cmp dword [ebp - 0xf4], 0x4550
lea ecx, [eax + ebx]
mov dword [ebp - 0x23c], ecx
jne 0x40262c
xor ecx, ecx
cmp dword [ebp - 0x74], ecx
je 0x40262c
movzx edx, word [ebp - 0xe0]
lea eax, [edx + eax + 0x18]
xor edx, edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x24c], ecx
cmp dx, word [ebp - 0xee]
jae 0x4021c4
lea esi, [eax + ebx]
jmp 0x402154
xor ecx, ecx
push 0x28
push ecx
lea eax, [ebp + 0x44]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
push 0
push 0x28
lea eax, [ebp + 0x44]
push eax
push esi
push dword [ebp - 0x248]
call edi
test eax, eax
je 0x40262c
cmp dword [ebp - 0x1c], 0
mov eax, dword [ebp + 0x54]
jne 0x40219b
mov ecx, dword [ebp + 0x50]
cmp dword [ebp - 0x74], ecx
jb 0x40219b
lea edx, [eax + ecx]
cmp dword [ebp - 0x74], edx
jae 0x40219b
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], eax
add eax, dword [ebp + 0x58]
cmp dword [ebp - 0x260], eax
jae 0x4021ac
mov dword [ebp - 0x260], eax
movzx eax, word [ebp - 0xee]
inc dword [ebp - 0x24c]
add esi, 0x28
cmp dword [ebp - 0x24c], eax
jb 0x402152
mov ecx, dword [ebp - 0x248]
lea eax, [ebp - 0xf4]
push eax
mov edx, ebx
call fcn.00401a0c
mov esi, dword [ebp + 0x7c]
mov ebx, dword [ebp + 0x7c]
imul esi, esi, 0x14
and dword [ebp - 0x250], 0
movzx eax, ax
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x70]
lea edi, [eax + esi + 7]
and edi, 0xfffffff8
shl ebx, 4
add ebx, edi
cmp dword [ebp + 0x7c], 0
pop ecx
mov dword [ebp - 0x25c], ebx
jbe 0x40223f
mov eax, dword [ebp - 0x270]
mov ecx, dword [ebp - 0x250]
push dword [eax + ecx*4]
call sub.MSVCR110.dll_strlen
add eax, 4
and eax, 0xfffffffc
add dword [ebp - 0x25c], eax
inc dword [ebp - 0x250]
mov eax, dword [ebp - 0x250]
pop ecx
cmp eax, dword [ebp + 0x7c]
jb 0x40220d
push dword [ebp - 0x25c]
call sub.MSVCR110.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x24c], eax
test eax, eax
je 0x40262c
push dword [ebp - 0x25c]
push 0
push eax
call sub.MSVCR110.dll_memset
mov eax, dword [ebp - 0xd4]
add eax, dword [ebp - 0xd0]
mov ecx, dword [ebp - 0x258]
add eax, dword [ebp - 0xd8]
add esp, 0xc
add eax, dword [ebp - 0xc8]
add eax, ecx
cmp ecx, eax
jae 0x402290
mov ecx, eax
push dword [ebp - 0x25c]
push ecx
push dword [ebp - 0x248]
call fcn.00401b2f
add esp, 0xc
mov dword [ebp - 0x278], eax
test eax, eax
je 0x402620
and dword [ebp - 0x254], 0
and dword [ebp - 0x234], 0
lea eax, [ebp - 0x254]
push eax
mov eax, dword [ebp - 0x74]
add eax, dword [ebp - 0x258]
push 0x40
push dword [ebp - 0x70]
push eax
push dword [ebp - 0x248]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x402620
mov eax, dword [ebp - 0x254]
mov ecx, dword [ebp - 0x258]
add esi, dword [ebp - 0x24c]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x278]
push 0
push dword [ebp - 0x70]
sub eax, ecx
mov dword [ebp - 0x264], eax
mov eax, dword [ebp - 0x74]
push esi
add eax, ecx
push eax
push dword [ebp - 0x248]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x402620
and dword [ebp - 0x250], 0
cmp dword [ebp + 0x7c], 0
jbe 0x4023fc
mov ecx, dword [ebp - 0x264]
mov eax, dword [ebp - 0x24c]
add ecx, edi
lea esi, [eax + 4]
mov dword [ebp - 0x268], ecx
lea edi, [edi + eax + 4]
mov ecx, dword [ebp - 0x250]
mov eax, dword [ebp - 0x270]
lea eax, [eax + ecx*4]
push dword [eax]
mov dword [ebp - 0x26c], eax
mov eax, dword [ebp - 0x25c]
sub eax, ebx
push eax
mov eax, dword [ebp - 0x24c]
add eax, ebx
push eax
call fcn.00401fa6
test eax, eax
js 0x402620
mov eax, dword [ebp - 0x268]
mov dword [esi - 4], eax
xor edx, edx
mov dword [edi], edx
add eax, 8
mov ecx, 0x80000001
mov dword [edi - 4], ecx
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x264]
mov dword [edi + 4], ecx
mov dword [edi + 8], edx
add eax, ebx
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x26c]
mov dword [esi], edx
mov dword [esi + 4], edx
push dword [eax]
call sub.MSVCR110.dll_strlen
add dword [ebp - 0x268], 0x10
add eax, 4
and eax, 0xfffffffc
add ebx, eax
inc dword [ebp - 0x250]
mov eax, dword [ebp - 0x250]
add edi, 0x10
add esi, 0x14
pop ecx
cmp eax, dword [ebp + 0x7c]
jb 0x40235d
mov eax, dword [ebp - 0x70]
xor edx, edx
push 0x14
pop ecx
div ecx
mov ecx, dword [ebp + 0x7c]
xor edx, edx
xor esi, esi
add ecx, eax
cmp ecx, edx
jbe 0x40242a
mov eax, dword [ebp - 0x24c]
cmp dword [eax], edx
jne 0x402422
cmp dword [eax + 0x10], edx
je 0x40242a
inc esi
add eax, 0x14
cmp esi, ecx
jb 0x402419
mov edi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push edx
push ebx
push dword [ebp - 0x24c]
push dword [ebp - 0x278]
push dword [ebp - 0x248]
call edi
test eax, eax
je 0x402620
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x402511
cmp dword [ebp - 8], 0
je 0x402511
mov esi, dword [ebp - 0x258]
push 0
lea ebx, [eax + esi]
push 0x14
lea eax, [ebp + 0x58]
push eax
push ebx
push dword [ebp - 0x248]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x402620
lea eax, [ebx + 0x10]
mov dword [ebp - 0x238], eax
mov eax, dword [ebp + 0x68]
and dword [ebp + 0x68], 0xfffffffe
mov dword [ebp - 0xf8], eax
lea eax, [ebp - 0x254]
push eax
push 4
push 0x14
push ebx
push dword [ebp - 0x248]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x402620
push 0
push 0x14
lea eax, [ebp + 0x58]
push eax
push ebx
push dword [ebp - 0x248]
call edi
test eax, eax
je 0x402620
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x254]
push 0x14
push ebx
mov ebx, dword [ebp - 0x248]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x402620
jmp 0x40251d
mov esi, dword [ebp - 0x258]
mov ebx, dword [ebp - 0x248]
lea eax, [ebp - 0x254]
push eax
push 0x40
push dword [ebp - 0xa0]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x402620
xor eax, eax
push eax
push 0x40
mov word [ebp + 0x20], ax
lea eax, [ebp + 4]
push eax
push esi
push ebx
call edi
test eax, eax
je 0x402620
push 0
push 0xf8
lea eax, [ebp - 0xf4]
push eax
mov eax, dword [ebp + 0x40]
add eax, esi
push eax
push ebx
call edi
test eax, eax
je 0x402620
lea eax, [ebp - 0xf4]
push eax
mov edx, esi
mov ecx, ebx
call fcn.00401a0c
movzx eax, ax
cmp ax, word [ebp - 0x260]
pop ecx
sbb ecx, ecx
neg ecx
add cx, word [ebp - 0x260]
mov dword [ebp - 0x26c], eax
sub ax, cx
cmp word [ebp + 0x20], ax
push 0
push 0x40
sbb ecx, ecx
neg ecx
add cx, ax
sub word [ebp + 0x20], cx
lea eax, [ebp + 4]
push eax
push esi
push ebx
call edi
test eax, eax
je 0x402620
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x254]
push dword [ebp - 0xa0]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x402620
lea eax, [ebp - 0xf4]
push eax
mov edx, esi
mov ecx, ebx
call fcn.00401a0c
pop ecx
cmp word [ebp - 0x260], ax
jne 0x402620
push 0x150
lea eax, [ebp - 0x244]
push eax
push 0x403168
push ebx
call fcn.00401d10
test eax, eax
je 0x402620
mov dword [ebp - 0x274], 1
push dword [ebp - 0x24c]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void__
pop ecx
mov ecx, dword [ebp + 0x6c]
mov eax, dword [ebp - 0x274]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040118b
add ebp, 0x70
leave
ret