Function at 0x4067d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xd0c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xd04], eax
mov eax, dword [esp + 0xd14]
push ebx
push ebp
mov ebp, dword [esp + 0xd18]
lea ecx, [eax + ebp]
push esi
push edi
mov dword [esp + 0x34], ecx
dec ebp
mov edi, dword [sym.imp.MSVCR90.dll__strupr]
cmp ebp, ecx
ja 0x406f8b
mov al, byte [ebp + 1]
inc ebp
cmp al, 0x53
je 0x406818
cmp al, 0x73
jne 0x406804
push 0x100
xor ebx, ebx
lea ecx, [esp + 0x224]
push ebx
push ecx
call sub.MSVCR90.dll_memset
push 0x100
lea edx, [esp + 0x530]
push ebx
push edx
call sub.MSVCR90.dll_memset
push 0x100
lea eax, [esp + 0x13c]
push ebx
push eax
call sub.MSVCR90.dll_memset
push 0x100
lea ecx, [esp + 0x848]
push ebx
push ecx
call sub.MSVCR90.dll_memset
push 0x100
lea edx, [esp + 0x454]
push ebx
push edx
call sub.MSVCR90.dll_memset
push 0x100
lea eax, [esp + 0x660]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0x48
push 0x100
lea ecx, [esp + 0x324]
push ebx
push ecx
call sub.MSVCR90.dll_memset
push 0x100
lea edx, [esp + 0x730]
push ebx
push edx
call sub.MSVCR90.dll_memset
lea eax, [esp + 0x78]
call fcn.004055f0
push 0x3ec
lea eax, [esp + 0x93c]
push ebx
push eax
call sub.MSVCR90.dll_memset
movzx ecx, byte [ebp]
mov byte [esp + 0x244], cl
movzx edx, byte [ebp + 1]
mov byte [esp + 0x245], dl
movzx eax, byte [ebp + 2]
mov byte [esp + 0x246], al
movzx ecx, byte [ebp + 3]
mov byte [esp + 0x247], cl
movzx edx, byte [ebp + 4]
mov byte [esp + 0x248], dl
movzx eax, byte [ebp + 5]
mov byte [esp + 0x249], al
movzx ecx, byte [ebp + 6]
lea edx, [esp + 0x244]
push edx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x24e], cl
add ebp, 7
mov esi, str.SYSTEM:
call edi
add esp, 0x28
jmp 0x406940
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x406960
cmp cl, bl
je 0x40695c
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x406960
add eax, 2
add esi, 2
cmp cl, bl
jne 0x406940
xor eax, eax
jmp 0x406965
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x406f8b
cmp byte [ebp], 0x20
jne 0x40697a
inc ebp
cmp byte [ebp], 0x20
je 0x406973
mov al, byte [ebp]
mov byte [esp + 0x520], al
mov cl, byte [ebp + 1]
mov byte [esp + 0x521], cl
mov dl, byte [ebp + 2]
lea eax, [esp + 0x520]
push eax
mov byte [esp + 0x526], dl
add ebp, 3
mov esi, 0x40d7d0
call edi
add esp, 4
lea ecx, [ecx]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x4069d0
cmp cl, bl
je 0x4069cc
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x4069d0
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4069b0
xor eax, eax
jmp 0x4069d5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x406f8b
xor ecx, ecx
nop
mov al, byte [ecx + ebp]
cmp al, 0xd
je 0x4069ef
cmp al, 0xa
je 0x4069ef
cmp al, 0x20
jne 0x4069f2
inc ecx
jmp 0x4069e0
add ebp, ecx
movzx ecx, byte [ebp]
mov byte [esp + 0x120], cl
movzx edx, byte [ebp + 1]
mov byte [esp + 0x121], dl
movzx eax, byte [ebp + 2]
mov byte [esp + 0x122], al
movzx ecx, byte [ebp + 3]
mov byte [esp + 0x123], cl
movzx edx, byte [ebp + 4]
mov byte [esp + 0x124], dl
movzx eax, byte [ebp + 5]
mov byte [esp + 0x125], al
movzx ecx, byte [ebp + 6]
mov byte [esp + 0x126], cl
movzx edx, byte [ebp + 7]
lea eax, [esp + 0x120]
push eax
mov byte [esp + 0x12b], dl
add ebp, 8
mov esi, str.ROMNAME:
call edi
add esp, 4
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x406a81
cmp cl, bl
je 0x406a7d
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x406a81
add eax, 2
add esi, 2
cmp cl, bl
jne 0x406a61
xor eax, eax
jmp 0x406a86
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x406f8b
cmp byte [ebp], 0x20
jne 0x406a9b
inc ebp
cmp byte [ebp], 0x20
je 0x406a94
mov cl, byte [ebp]
xor esi, esi
mov eax, ebp
cmp cl, 0xd
je 0x406ac4
lea edx, [esp + 0x820]
sub edx, ebp
cmp cl, 0xa
je 0x406ac4
mov byte [edx + eax], cl
mov cl, byte [eax + 1]
inc eax
inc esi
cmp cl, 0xd
jne 0x406ab0
inc eax
inc esi
mov cl, byte [eax]
cmp cl, 0xd
je 0x406ad5
cmp cl, 0xa
je 0x406ad5
cmp cl, 0x20
jne 0x406ad9
inc eax
inc esi
jmp 0x406ac4
lea eax, [esp + 0x820]
add ebp, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x406ae5
mov ecx, dword [0x438028]
push 0x40
sub eax, edx
push 0x1000
lea edi, [eax + 1]
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
cmp esi, ebx
je 0x406b4b
mov ecx, dword [0x438028]
lea edx, [esp + 0x28]
push edx
push edi
lea eax, [esp + 0x828]
push eax
push esi
push ecx
mov dword [esp + 0x3c], ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x406b4d
cmp dword [esp + 0x28], edi
je 0x406b4d
mov edx, dword [0x438028]
push 0x4000
push edi
push esi
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor esi, esi
mov dword [esp + 0x64], esi
lea eax, [esp + 0x64]
mov eax, dword [eax]
lea ecx, [esp + 0x920]
mov dword [ecx], eax
movzx eax, byte [ebp]
mov byte [esp + 0x420], al
movzx ecx, byte [ebp + 1]
mov byte [esp + 0x421], cl
mov dl, byte [ebp + 2]
mov byte [esp + 0x422], dl
movzx eax, byte [ebp + 3]
mov byte [esp + 0x423], al
movzx ecx, byte [ebp + 4]
lea edx, [esp + 0x420]
push edx
mov byte [esp + 0x428], cl
add ebp, 5
mov esi, str.GAME:
call dword [sym.imp.MSVCR90.dll__strupr]
add esp, 4
nop
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x406bd0
cmp cl, bl
je 0x406bcc
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x406bd0
add eax, 2
add esi, 2
cmp cl, bl
jne 0x406bb0
xor eax, eax
jmp 0x406bd5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x406f8b
cmp byte [ebp], 0x20
jne 0x406bea
inc ebp
cmp byte [ebp], 0x20
je 0x406be3
mov cl, byte [ebp]
xor esi, esi
mov eax, ebp
cmp cl, 0xd
je 0x406c14
lea edx, [esp + 0x620]
sub edx, ebp
nop
cmp cl, 0xa
je 0x406c14
mov byte [edx + eax], cl
mov cl, byte [eax + 1]
inc eax
inc esi
cmp cl, 0xd
jne 0x406c00
inc eax
inc esi
mov cl, byte [eax]
cmp cl, 0xd
je 0x406c25
cmp cl, 0xa
je 0x406c25
cmp cl, 0x20
jne 0x406c29
inc eax
inc esi
jmp 0x406c14
lea eax, [esp + 0x620]
add ebp, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x406c35
push 0x40
sub eax, edx
push 0x1000
lea edi, [eax + 1]
mov eax, dword [0x438028]
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
cmp esi, ebx
je 0x406c99
mov eax, dword [0x438028]
lea ecx, [esp + 0x20]
push ecx
push edi
lea edx, [esp + 0x628]
push edx
push esi
push eax
mov dword [esp + 0x34], ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x406c9b
cmp dword [esp + 0x20], edi
je 0x406c9b
mov ecx, dword [0x438028]
push 0x4000
push edi
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor esi, esi
mov dword [esp + 0x60], esi
mov al, byte [ebp]
cmp al, 0x50
je 0x406cb3
cmp al, 0x70
je 0x406cb3
mov dword [esp + 0x68], ebx
jmp 0x406e0a
mov byte [esp + 0x320], al
movzx edx, byte [ebp + 1]
mov byte [esp + 0x321], dl
movzx eax, byte [ebp + 2]
mov byte [esp + 0x322], al
movzx ecx, byte [ebp + 3]
mov byte [esp + 0x323], cl
movzx edx, byte [ebp + 4]
mov byte [esp + 0x324], dl
movzx eax, byte [ebp + 5]
mov byte [esp + 0x325], al
movzx ecx, byte [ebp + 6]
lea edx, [esp + 0x320]
push edx
mov byte [esp + 0x32a], cl
add ebp, 7
mov esi, str.PARENT:
call dword [sym.imp.MSVCR90.dll__strupr]
add esp, 4
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x406d35
cmp cl, bl
je 0x406d31
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x406d35
add eax, 2
add esi, 2
cmp cl, bl
jne 0x406d15
xor eax, eax
jmp 0x406d3a
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x406f8b
cmp byte [ebp], 0x20
jne 0x406d4f
inc ebp
cmp byte [ebp], 0x20
je 0x406d48
mov cl, byte [ebp]
xor esi, esi
mov eax, ebp
cmp cl, 0xd
je 0x406d78
lea edx, [esp + 0x720]
sub edx, ebp
cmp cl, 0xa
je 0x406d78
mov byte [edx + eax], cl
mov cl, byte [eax + 1]
inc eax
inc esi
cmp cl, 0xd
jne 0x406d64
inc eax
inc esi
mov cl, byte [eax]
cmp cl, 0xd
je 0x406d89
cmp cl, 0xa
je 0x406d89
cmp cl, 0x20
jne 0x406d8d
inc eax
inc esi
jmp 0x406d78
lea eax, [esp + 0x720]
add ebp, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x406da0
push 0x40
sub eax, edx
push 0x1000
lea edi, [eax + 1]
mov eax, dword [0x438028]
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
cmp esi, ebx
je 0x406e04
mov eax, dword [0x438028]
lea ecx, [esp + 0x24]
push ecx
push edi
lea edx, [esp + 0x728]
push edx
push esi
push eax
mov dword [esp + 0x38], ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x406e06
cmp dword [esp + 0x24], edi
je 0x406e06
mov ecx, dword [0x438028]
push 0x4000
push edi
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor esi, esi
mov dword [esp + 0x68], esi
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x3c]
push eax
lea esi, [esp + 0x54]
lea edx, [esp + 0x92c]
mov ecx, ebp
call fcn.00405890
mov eax, dword [esp + 0x20]
add ebp, dword [esp + 0x1c]
lea eax, [esp + eax + 0x92c]
mov edi, eax
add eax, 0x28
mov ecx, 0xa
mov esi, 0x4269b4
rep movsd dword es:[edi], dword [esi]
mov edi, eax
add eax, 0x28
mov ecx, 0xa
mov esi, 0x4269dc
rep movsd dword es:[edi], dword [esi]
mov edi, eax
mov dword [esp + 0x38], eax
add eax, 0x28
mov ecx, 0xa
mov esi, 0x426a04
rep movsd dword es:[edi], dword [esi]
push eax
lea esi, [esp + 0x20]
lea ebx, [esp + 0x58]
mov ecx, ebp
mov dword [esp + 0x38], eax
call fcn.00405af0
mov ebx, dword [esp + 0x38]
add ebp, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
lea ecx, [esp + 0x44]
push ecx
lea edi, [esp + 0x5c]
mov edx, ebx
mov ecx, ebp
call fcn.00405be0
add ebp, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
mov edx, edi
push edx
lea edi, [esp + 0x4c]
mov edx, ebx
mov ecx, ebp
call fcn.00405d80
add ebp, dword [esp + 0x28]
add ebx, dword [esp + 0x2c]
lea eax, [esp + 0x60]
push eax
mov edx, ebx
mov ecx, ebp
call fcn.00405ef0
mov eax, dword [esp + 0x30]
add ebp, dword [esp + 0x2c]
xor edx, edx
xor ecx, ecx
mov dword [eax + ebx], ecx
mov dword [esp + 0x50], ecx
mov ecx, edx
xor esi, esi
mov dword [eax + ebx + 4], esi
mov dword [eax + ebx + 8], ecx
mov ecx, dword [esp + 0x48]
mov dword [eax + ebx + 0xc], edx
mov dword [esp + 0x5c], edx
mov dword [esp + 0x58], edx
mov edi, 0xb
lea edx, [esp + 0x78]
mov dword [eax + ebx + 0x10], edi
push edx
mov dword [esp + 0x64], edi
lea edi, [esp + 0x30]
mov edx, ebp
mov dword [esp + 0x58], esi
call fcn.00406180
add esp, 0x1c
mov edx, dword [0x43801c]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add ebp, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
mov eax, dword [0x438028]
push 0xbc
lea ecx, [esp + 0x68]
push ecx
push edx
push eax
call esi
mov eax, dword [0x438020]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [0x438028]
push 0x3ec
lea edx, [esp + 0x928]
push edx
push eax
push ecx
call esi
add dword [0x43801c], 0xbc
add dword [0x438020], 0x3ec
inc dword [0x438024]
mov ecx, dword [esp + 0x34]
jmp 0x4067fe
mov ecx, dword [esp + 0xd14]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor al, al
call fcn.004098be
add esp, 0xd0c
ret