Function at 0x401070
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Execute shellcode via indirect call
Get system information on windows
Inspect section memory permissions
Parse pe header

Disassembly:
sub esp, 0x38
push esi
mov esi, dword [esp + 0x40]
cmp word [esi], 0x5a4d
je 0x401088
xor eax, eax
pop esi
add esp, 0x38
ret 8
push ebp
mov ebp, dword [esi + 0x3c]
mov eax, dword [ebp + esi]
add ebp, esi
cmp eax, 0x4550
jne 0x40141c
cmp word [ebp + 0x14], 0xe0
jne 0x40141c
mov eax, dword [ebp + 0x80]
test eax, eax
je 0x40141c
cmp word [ebp + 0x18], 0x10b
jne 0x40141c
mov ax, word [ebp + 6]
cmp ax, 1
jb 0x40141c
movzx ecx, word [ebp + 0x14]
movzx eax, ax
push ebx
push edi
lea edi, [eax + eax*4]
shl edi, 3
lea edx, [ecx + ebp + 0x18]
sub edi, esi
xor eax, eax
add edi, edx
mov dword [esp + 0x10], eax
cmp word [ebp + 6], ax
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], edi
mov ebx, edi
jbe 0x401126
mov edi, edi
lea ecx, [eax + eax*4]
mov esi, dword [edx + ecx*8 + 0x10]
lea ecx, [edx + ecx*8]
mov ecx, dword [ecx + 0xc]
add ecx, esi
cmp ebx, ecx
jae 0x401115
mov ebx, ecx
inc eax
mov dword [esp + 0x10], eax
movzx ecx, word [ebp + 6]
cmp eax, ecx
jb 0x401100
mov esi, dword [esp + 0x4c]
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x28]
lea eax, [ecx + ebx - 1]
xor edx, edx
div ecx
push 0x40
push 0x1000
imul ecx, eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
je 0x4013f6
mov ecx, edi
mov eax, ecx
shr ecx, 2
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x10], eax
cmp word [ebp + 6], ax
jbe 0x4011bc
jmp 0x401180
mov edx, dword [esp + 0x14]
lea ecx, [eax + eax*4]
mov esi, dword [edx + ecx*8 + 0x14]
mov edi, dword [edx + ecx*8 + 0xc]
lea eax, [edx + ecx*8]
mov ecx, dword [eax + 0x10]
mov edx, dword [esp + 0x4c]
mov eax, ecx
shr ecx, 2
add esi, edx
add edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
movzx ecx, word [ebp + 6]
cmp eax, ecx
jb 0x401180
mov ebp, dword [ebx + 0x3c]
movzx edx, word [ebp + ebx + 0x14]
mov esi, dword [ebp + ebx + 0x80]
add ebp, ebx
lea eax, [edx + ebp + 0x18]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], eax
add esi, ebx
mov edi, dword [esi + 0xc]
test edi, edi
mov dword [esp + 0x1c], esi
jne 0x4011f1
mov eax, dword [esi + 4]
test eax, eax
je 0x40127e
add edi, ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
mov dword [esp + 0x4c], eax
jne 0x401215
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esp + 0x4c], eax
je 0x4013e8
mov ebp, dword [esi]
mov edi, dword [esi + 0x10]
mov eax, dword [ebp + ebx]
add ebp, ebx
add edi, ebx
test eax, eax
je 0x401272
js 0x401253
lea esi, [eax + ebx + 2]
push esi
call section..text
add esp, 4
test eax, eax
jne 0x40124d
mov ecx, dword [esp + 0x4c]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401402
mov esi, dword [esp + 0x1c]
jmp 0x401263
mov edx, dword [esp + 0x4c]
and eax, 0xffff
push eax
push edx
call fcn.00401bf0
add ebp, 4
mov dword [edi], eax
mov eax, dword [ebp]
add edi, 4
test eax, eax
jne 0x401226
mov ebp, dword [esp + 0x18]
add esi, 0x14
jmp 0x4011db
mov edx, dword [ebp + 0xa0]
test edx, edx
je 0x4012e9
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x4012e9
mov eax, dword [edx + 4]
lea edi, [edx + 8]
add eax, edx
cmp edi, eax
jae 0x4012dd
lea ecx, [ecx]
movzx eax, word [edi]
mov ecx, eax
and ecx, 0xf000
cmp ecx, 0x3000
jne 0x4012c9
mov esi, dword [edx]
and eax, 0xfff
add eax, esi
mov esi, dword [ebp + 0x34]
add eax, ebx
mov ecx, ebx
sub ecx, esi
add dword [eax], ecx
jmp 0x4012d1
test ecx, ecx
jne 0x401402
mov eax, dword [edx + 4]
add edi, 2
add eax, edx
cmp edi, eax
jb 0x4012a0
mov ecx, dword [edx + 4]
mov eax, dword [edx + ecx]
add edx, ecx
test eax, eax
jne 0x401291
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
lea eax, [ecx + edx - 1]
xor edx, edx
div ecx
imul eax, ecx
lea ecx, [esp + 0x10]
push ecx
push 0x20
push eax
push ebx
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x401402
xor ecx, ecx
mov dword [esp + 0x10], ecx
cmp word [ebp + 6], cx
jbe 0x4013d0
mov ebp, dword [esp + 0x28]
jmp 0x401330
mov eax, dword [esp + 0x14]
lea edx, [ecx + ecx*4]
mov edi, dword [eax + edx*8 + 0xc]
lea eax, [eax + edx*8]
mov edx, dword [eax + 0x10]
lea eax, [edx + edi - 1]
xor edx, edx
div ebp
xor edx, edx
mov esi, eax
mov eax, edi
div ebp
mov edi, eax
cmp edi, esi
ja 0x4013b9
jmp 0x401360
mov edx, dword [esp + 0x14]
lea eax, [ecx + ecx*4]
mov eax, dword [edx + eax*8 + 0x24]
test eax, 0xe0000000
je 0x401379
mov eax, 4
jmp 0x401393
test eax, 0x60000000
je 0x401387
mov eax, 0x20
jmp 0x401393
test eax, 0x40000000
je 0x4013b4
mov eax, 2
mov edx, edi
imul edx, ebp
lea ecx, [esp + 0x4c]
push ecx
push eax
push ebp
add edx, ebx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x401402
mov ecx, dword [esp + 0x10]
mov ebp, dword [esp + 0x28]
inc edi
cmp edi, esi
jbe 0x401360
mov eax, dword [esp + 0x18]
inc ecx
mov dword [esp + 0x10], ecx
movzx edx, word [eax + 6]
cmp ecx, edx
jb 0x401330
mov ebp, eax
mov eax, dword [ebp + 0x28]
push 0
push 1
push ebx
add eax, ebx
call eax
pop edi
mov eax, ebx
pop ebx
pop ebp
pop esi
add esp, 0x38
ret 8
push 0x8000
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop ebx
pop ebp
xor eax, eax
pop esi
add esp, 0x38
ret 8
push 0x8000
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop ebx
pop ebp
xor eax, eax
pop esi
add esp, 0x38
ret 8
pop ebp
xor eax, eax
pop esi
add esp, 0x38
ret 8