Function at 0x402a70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0xd14
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xd0c], eax
mov eax, dword [esp + 0xd1c]
push ebx
push ebp
mov ebp, dword [esp + 0xd20]
cmp byte [ebp], 0x25
push esi
lea ecx, [eax + ebp]
push edi
mov dword [esp + 0x50], ecx
je 0x402ab0
xor al, al
jmp 0x403275
cmp ebp, ecx
jae 0x402aa3
mov al, byte [ebp + 1]
inc ebp
cmp al, 0x25
je 0x402ab0
cmp al, 0x20
je 0x402ab0
xor ebx, ebx
xor ecx, ecx
mov al, byte [ecx + ebp]
cmp al, 0xd
je 0x402ad3
cmp al, 0xa
je 0x402ad3
cmp al, 0x20
jne 0x402ad6
inc ecx
jmp 0x402ac4
add ebp, ecx
mov edi, dword [sym.imp.MSVCR90.dll__strupr]
push 0xbc
lea ecx, [esp + 0x6c]
push ebx
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov al, byte [ebp]
cmp al, 0xd
je 0x402b00
cmp al, 0xa
je 0x402b00
cmp al, 0x20
jne 0x402b03
inc ebp
jmp 0x402af1
push 0x100
lea edx, [esp + 0x32c]
push ebx
push edx
mov dword [esp + 0x2c], ebx
call sub.MSVCR90.dll_memset
push 0x100
lea eax, [esp + 0x538]
push ebx
push eax
call sub.MSVCR90.dll_memset
push 0x100
lea ecx, [esp + 0x144]
push ebx
push ecx
call sub.MSVCR90.dll_memset
push 0x100
lea edx, [esp + 0x650]
push ebx
push edx
call sub.MSVCR90.dll_memset
push 0x100
lea eax, [esp + 0x45c]
push ebx
push eax
call sub.MSVCR90.dll_memset
push 0x100
lea ecx, [esp + 0x868]
push ebx
push ecx
call sub.MSVCR90.dll_memset
add esp, 0x48
push 0x100
lea edx, [esp + 0x22c]
push ebx
push edx
call sub.MSVCR90.dll_memset
push 0x100
lea eax, [esp + 0x738]
push ebx
push eax
call sub.MSVCR90.dll_memset
push 0x3ec
lea ecx, [esp + 0x944]
push ebx
push ecx
call sub.MSVCR90.dll_memset
movzx edx, byte [ebp]
mov byte [esp + 0x34c], dl
movzx eax, byte [ebp + 1]
mov byte [esp + 0x34d], al
movzx ecx, byte [ebp + 2]
mov byte [esp + 0x34e], cl
movzx edx, byte [ebp + 3]
mov byte [esp + 0x34f], dl
movzx eax, byte [ebp + 4]
mov byte [esp + 0x350], al
movzx ecx, byte [ebp + 5]
mov byte [esp + 0x351], cl
movzx edx, byte [ebp + 6]
lea eax, [esp + 0x34c]
push eax
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x356], dl
add ebp, 7
mov esi, str.SYSTEM:
call edi
add esp, 0x28
nop
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x402c40
cmp cl, bl
je 0x402c3c
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x402c40
add eax, 2
add esi, 2
cmp cl, bl
jne 0x402c20
xor eax, eax
jmp 0x402c45
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x402aa3
cmp byte [ebp], 0x20
jne 0x402c5a
inc ebp
cmp byte [ebp], 0x20
je 0x402c53
movzx ecx, byte [ebp]
mov byte [esp + 0x528], cl
mov dl, byte [ebp + 1]
mov byte [esp + 0x529], dl
mov al, byte [ebp + 2]
mov byte [esp + 0x52a], al
movzx ecx, byte [ebp + 3]
lea edx, [esp + 0x528]
push edx
mov byte [esp + 0x52f], cl
add ebp, 4
mov esi, str.CPS2
call edi
add esp, 4
lea esp, [esp]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x402cc0
cmp cl, bl
je 0x402cbc
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x402cc0
add eax, 2
add esi, 2
cmp cl, bl
jne 0x402ca0
xor eax, eax
jmp 0x402cc5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x402aa3
xor ecx, ecx
nop
mov al, byte [ecx + ebp]
cmp al, 0xd
je 0x402cdf
cmp al, 0xa
je 0x402cdf
cmp al, 0x20
jne 0x402ce2
inc ecx
jmp 0x402cd0
movzx eax, byte [ebp + ecx]
add ebp, ecx
mov byte [esp + 0x128], al
movzx ecx, byte [ebp + 1]
mov byte [esp + 0x129], cl
movzx edx, byte [ebp + 2]
mov byte [esp + 0x12a], dl
movzx eax, byte [ebp + 3]
mov byte [esp + 0x12b], al
movzx ecx, byte [ebp + 4]
mov byte [esp + 0x12c], cl
movzx edx, byte [ebp + 5]
mov byte [esp + 0x12d], dl
movzx eax, byte [ebp + 6]
mov byte [esp + 0x12e], al
movzx ecx, byte [ebp + 7]
lea edx, [esp + 0x128]
push edx
mov byte [esp + 0x133], cl
add ebp, 8
mov esi, str.ROMNAME:
call edi
add esp, 4
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x402d72
cmp cl, bl
je 0x402d6e
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x402d72
add eax, 2
add esi, 2
cmp cl, bl
jne 0x402d52
xor eax, eax
jmp 0x402d77
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x402aa3
cmp byte [ebp], 0x20
jne 0x402d8c
inc ebp
cmp byte [ebp], 0x20
je 0x402d85
mov al, byte [ebp]
cmp al, 0xd
je 0x402daf
lea ecx, [esp + 0x628]
lea ebx, [ebx]
cmp al, 0xa
je 0x402daf
inc ebp
mov byte [ecx], al
mov al, byte [ebp]
inc ecx
cmp al, 0xd
jne 0x402da0
lea eax, [esp + 0x628]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402dc0
push 0x40
sub eax, edx
push 0x1000
lea edi, [eax + 1]
mov eax, dword [0x438028]
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
cmp esi, ebx
je 0x402e24
mov eax, dword [0x438028]
lea ecx, [esp + 0x38]
push ecx
push edi
lea edx, [esp + 0x630]
push edx
push esi
push eax
mov dword [esp + 0x4c], ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x402e26
cmp dword [esp + 0x38], edi
je 0x402e26
mov ecx, dword [0x438028]
push 0x4000
push edi
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor esi, esi
mov dword [esp + 0x20], esi
lea eax, [esp + 0x20]
mov eax, dword [eax]
lea ecx, [esp + 0x928]
mov dword [ecx], eax
xor ecx, ecx
jmp 0x402e40
mov al, byte [ecx + ebp]
cmp al, 0xd
je 0x402e4f
cmp al, 0xa
je 0x402e4f
cmp al, 0x20
jne 0x402e52
inc ecx
jmp 0x402e40
movzx edx, byte [ebp + ecx]
add ebp, ecx
mov byte [esp + 0x428], dl
movzx eax, byte [ebp + 1]
mov byte [esp + 0x429], al
mov cl, byte [ebp + 2]
mov byte [esp + 0x42a], cl
movzx edx, byte [ebp + 3]
mov byte [esp + 0x42b], dl
movzx eax, byte [ebp + 4]
lea ecx, [esp + 0x428]
push ecx
mov byte [esp + 0x430], al
add ebp, 5
mov esi, str.GAME:
call dword [sym.imp.MSVCR90.dll__strupr]
add esp, 4
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x402ec4
cmp cl, bl
je 0x402ec0
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x402ec4
add eax, 2
add esi, 2
cmp cl, bl
jne 0x402ea4
xor eax, eax
jmp 0x402ec9
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x402aa3
cmp byte [ebp], 0x20
jne 0x402ede
inc ebp
cmp byte [ebp], 0x20
je 0x402ed7
mov al, byte [ebp]
cmp al, 0xd
je 0x402eff
lea ecx, [esp + 0x828]
lea esp, [esp]
cmp al, 0xa
je 0x402eff
inc ebp
mov byte [ecx], al
mov al, byte [ebp]
inc ecx
cmp al, 0xd
jne 0x402ef0
lea eax, [esp + 0x828]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402f10
push 0x40
sub eax, edx
mov edx, dword [0x438028]
push 0x1000
lea edi, [eax + 1]
push edi
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
cmp esi, ebx
jne 0x402f3e
mov dword [esp + 0x2c], ebx
jmp 0x402f85
mov edx, dword [0x438028]
lea eax, [esp + 0x30]
push eax
push edi
lea ecx, [esp + 0x830]
push ecx
push esi
push edx
mov dword [esp + 0x44], ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x402f81
cmp dword [esp + 0x30], edi
je 0x402f81
mov eax, dword [0x438028]
push 0x4000
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov dword [esp + 0x2c], ebx
jmp 0x402f85
mov dword [esp + 0x2c], esi
xor ecx, ecx
mov al, byte [ecx + ebp]
cmp al, 0xd
je 0x402f96
cmp al, 0xa
je 0x402f96
cmp al, 0x20
jne 0x402f99
inc ecx
jmp 0x402f87
add ebp, ecx
cmp byte [ebp], 0x50
jne 0x4030fd
mov byte [esp + 0x228], 0x50
movzx ecx, byte [ebp + 1]
mov byte [esp + 0x229], cl
movzx edx, byte [ebp + 2]
mov byte [esp + 0x22a], dl
movzx eax, byte [ebp + 3]
mov byte [esp + 0x22b], al
movzx ecx, byte [ebp + 4]
mov byte [esp + 0x22c], cl
movzx edx, byte [ebp + 5]
mov byte [esp + 0x22d], dl
movzx eax, byte [ebp + 6]
lea ecx, [esp + 0x228]
push ecx
mov byte [esp + 0x232], al
add ebp, 7
mov esi, str.PARENT:
call dword [sym.imp.MSVCR90.dll__strupr]
add esp, 4
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x403028
cmp cl, bl
je 0x403024
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x403028
add eax, 2
add esi, 2
cmp cl, bl
jne 0x403008
xor eax, eax
jmp 0x40302d
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x402aa3
cmp byte [ebp], 0x20
jne 0x403047
jmp 0x403040
inc ebp
cmp byte [ebp], 0x20
je 0x403040
mov al, byte [ebp]
cmp al, 0xd
je 0x403064
lea ecx, [esp + 0x728]
cmp al, 0xa
je 0x403064
inc ebp
mov byte [ecx], al
mov al, byte [ebp]
inc ecx
cmp al, 0xd
jne 0x403055
lea eax, [esp + 0x728]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403070
push 0x40
sub eax, edx
mov edx, dword [0x438028]
push 0x1000
lea edi, [eax + 1]
push edi
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
cmp esi, ebx
jne 0x40309e
mov dword [esp + 0x1c], ebx
jmp 0x4030e5
mov edx, dword [0x438028]
lea eax, [esp + 0x34]
push eax
push edi
lea ecx, [esp + 0x730]
push ecx
push esi
push edx
mov dword [esp + 0x48], ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x4030e1
cmp dword [esp + 0x34], edi
je 0x4030e1
mov eax, dword [0x438028]
push 0x4000
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov dword [esp + 0x1c], ebx
jmp 0x4030e5
mov dword [esp + 0x1c], esi
xor ecx, ecx
mov al, byte [ecx + ebp]
cmp al, 0xd
je 0x4030f6
cmp al, 0xa
je 0x4030f6
cmp al, 0x20
jne 0x4030f9
inc ecx
jmp 0x4030e7
add ebp, ecx
jmp 0x403101
mov dword [esp + 0x1c], ebx
lea ecx, [esp + 0x54]
push ecx
push ebp
lea esi, [esp + 0x1c]
lea ebx, [esp + 0x44]
lea ecx, [esp + 0x934]
call fcn.00402490
mov edi, dword [esp + 0x20]
add ebp, dword [esp + 0x1c]
lea edx, [esp + 0x5c]
push edx
lea edi, [esp + edi + 0x938]
push ebp
mov ecx, edi
call fcn.004025e0
add edi, dword [esp + 0x28]
add ebp, dword [esp + 0x24]
lea eax, [esp + 0x64]
push eax
push edi
mov dword [esp + 0x40], edi
mov edi, ebx
mov ecx, ebp
call fcn.00401470
mov eax, dword [esp + 0x40]
add eax, dword [esp + 0x30]
add ebp, dword [esp + 0x2c]
lea ecx, [esp + 0x6c]
push ecx
push eax
mov ecx, ebp
mov dword [esp + 0x48], eax
call fcn.00402740
add ebp, dword [esp + 0x34]
add esp, 0x20
lea ecx, [esp + 0x68]
mov edx, ebp
call fcn.00402890
xor edi, edi
cmp eax, edi
je 0x402aa3
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x68], edx
add ebp, eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x70], ecx
mov ecx, dword [esp + 0x28]
xor edx, edx
mov dword [eax + ecx], edx
mov dword [eax + ecx + 4], edi
mov dword [esp + 0x3c], edx
xor esi, esi
mov edx, edi
mov dword [eax + ecx + 8], edx
mov edx, dword [0x43801c]
mov dword [eax + ecx + 0xc], esi
mov ebx, 0xb
mov dword [eax + ecx + 0x10], ebx
lea eax, [esp + 0x24]
push eax
mov eax, dword [0x438028]
push 0xbc
lea ecx, [esp + 0x70]
push ecx
push edx
mov dword [esp + 0x58], esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
mov dword [esp + 0x54], edi
mov dword [esp + 0x60], ebx
mov dword [esp + 0x58], edi
call esi
mov eax, dword [0x438020]
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [0x438028]
push 0x3ec
lea edx, [esp + 0x930]
push edx
push eax
push ecx
call esi
add dword [0x43801c], 0xbc
add dword [0x438020], 0x3ec
inc dword [0x438024]
mov edi, edi
mov al, byte [ebp]
cmp al, 0xd
je 0x40324f
cmp al, 0xa
je 0x40324f
cmp al, 0x20
jne 0x403252
inc ebp
jmp 0x403240
cmp byte [ebp], 0x25
jne 0x403273
mov al, byte [ebp]
cmp al, 0x25
je 0x403263
cmp al, 0x20
jne 0x403266
inc ebp
jmp 0x403258
cmp ebp, dword [esp + 0x50]
ja 0x403273
xor ebx, ebx
jmp 0x402ad8
mov al, 1
mov ecx, dword [esp + 0xd1c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004098be
add esp, 0xd14
ret