Function at 0x401240
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 4
push 0x1000
push 0x100000
push 0
call esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xc], eax
push eax
lea edi, [ebp - 4]
mov eax, ebx
mov dword [ebp - 4], 0x100000
call fcn.004010e0
mov edi, eax
add esp, 4
test edi, edi
je 0x40129b
push edi
push ebx
push str.LoadFile__s__d_r_n
call fcn.00401ce3
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, section.ldr
cmp byte [eax], 0xe9
jne 0x4012ba
mov eax, section.ldr
mov eax, dword [eax + 1]
add eax, section.ldr
add eax, 5
mov dword [ebp - 8], eax
jmp 0x4012c1
mov dword [ebp - 8], section.ldr
mov ebx, dword [ebp - 4]
push 0x40
push 0x1000
lea ecx, [ebx + 0x550c]
push ecx
push 0
call esi
mov esi, eax
test esi, esi
jne 0x4012fb
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push str.VirtualAlloc_____d_r_n
call fcn.00401ce3
add esp, 8
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov word [esi], 0xe8
mov word [esi + 2], 0
mov word [esi + 4], 0x5800
mov word [esi + 6], 0xe883
mov word [esi + 8], 0x6805
mov word [esi + 0xa], 0x150c
mov word [esi + 0xc], 0
push 0x150c
mov word [esi + 0xe], 0xce8
lea eax, [esi + 0x13]
push 0x58
mov word [esi + 0x10], 0x15
push eax
mov byte [esi + 0x12], 0
call fcn.00405e60
mov edi, dword [ebp - 4]
mov byte [esi + 0x151f], 0x68
mov byte [esi + 0x1520], bl
mov eax, ebx
sar eax, 8
mov byte [esi + 0x1521], al
mov ecx, ebx
sar ecx, 0x10
mov byte [esi + 0x1522], cl
mov edx, ebx
sar edx, 0x18
mov byte [esi + 0x1523], dl
mov byte [esi + 0x1524], 0xe8
mov byte [esi + 0x1525], bl
mov byte [esi + 0x1526], al
add esp, 0xc
xor eax, eax
mov byte [esi + 0x1527], cl
mov byte [esi + 0x1528], dl
mov ebx, 0x1529
test edi, edi
jle 0x4013b1
mov edx, dword [ebp - 0xc]
mov cl, byte [eax + edx]
mov byte [ebx + esi], cl
inc eax
inc ebx
cmp eax, edi
jl 0x4013a2
mov byte [ebx + esi], 0x68
mov word [ebx + esi + 5], 0xe850
mov word [ebx + esi + 7], 1
mov word [ebx + esi + 9], 0
mov byte [ebx + esi + 0xb], 0xc3
lea edi, [ebx + 1]
add ebx, 0xc
mov dword [ebp - 4], ebx
call section..text
mov edx, dword [ebp - 8]
mov cl, 0xcc
cmp byte [eax + edx - 1], cl
jne 0x4013ef
dec eax
cmp byte [edx + eax - 1], cl
je 0x4013e8
add eax, 0xf
and eax, 0xfffffff0
mov ecx, 0
jle 0x401412
jmp 0x401403
mov edx, dword [ebp - 8]
mov dl, byte [ecx + edx]
mov byte [ebx + esi], dl
inc ecx
inc ebx
cmp ecx, eax
jl 0x401400
mov dword [ebp - 4], ebx
mov edx, dword [ebp + 8]
mov byte [edi + esi], bl
mov eax, ebx
sar eax, 8
mov byte [edi + esi + 1], al
mov ecx, ebx
sar ecx, 0x10
push edx
lea eax, [ebp - 0x40c]
mov byte [edi + esi + 2], cl
sar ebx, 0x18
push eax
mov byte [edi + esi + 3], bl
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str..ldr
lea ecx, [ebp - 0x40c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
lea edi, [ebp - 4]
lea eax, [ebp - 0x40c]
call fcn.00401190
add esp, 4
test eax, eax
je 0x401485
push eax
lea edx, [ebp - 0x40c]
push edx
push str.SaveFile__s__d_r_n
call fcn.00401ce3
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
push eax
push str.make__d_bytes_ok____r_n
call fcn.00401ce3
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret