Function at 0x4030f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get file size
Read file on windows

Disassembly:
sub esp, 0x424
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x34]
push 0x400
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0x8000000
push 3
push 0
push 1
lea ecx, [esp + 0x48]
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push edi
push 0x102
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
mov ebp, esi
lea edx, [esp + 0x24]
push 0
push edx
push edi
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403179
mov eax, dword [esp + 0x24]
add ebp, eax
sub edi, eax
je 0x40319b
test eax, eax
je 0x403375
jmp 0x403151
mov esi, dword [esp + 0x20]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x424
ret 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x3c]
mov ebp, dword [esi + 0x20]
mov ebx, dword [esi + 0x1c]
xor ecx, ecx
mov cx, word [eax + esi + 0x14]
lea edi, [eax + esi + 4]
push 0x40
push 0x2000
lea edx, [ecx + edi + 0x14]
push ebp
push ebx
mov dword [esp + 0x24], edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x4031e1
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x424
ret 0x10
push 0x40
push 0x1000
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x28], eax
jne 0x40320a
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x424
ret 0x10
mov edx, dword [esp + 0x14]
xor eax, eax
mov ax, word [edi + 2]
mov dword [esp + 0x10], ebx
mov edi, 0x65
lea ecx, [eax + eax*4]
mov ebp, dword [edx + ecx*8 - 0x28]
lea ecx, [edx + ecx*8]
cmp ebp, 0x78657a2e
jne 0x403241
cmp word [ecx - 0x24], di
jne 0x403241
mov ebx, dword [ecx - 0x14]
mov ebp, dword [ecx - 0x18]
add ebx, esi
mov dword [esp + 0x10], ebp
lea eax, [eax + eax*4 - 0xa]
lea eax, [edx + eax*8]
cmp dword [eax], 0x78657a2e
jne 0x403262
cmp word [eax + 4], di
jne 0x403262
mov ebx, dword [ecx - 0x3c]
mov ecx, dword [ecx - 0x40]
add ebx, esi
mov dword [esp + 0x10], ecx
test ebx, ebx
jne 0x403276
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x424
ret 0x10
mov eax, dword [esp + 0x10]
mov edx, dword [ebx]
add eax, 0x100000
mov dword [esp + 0x30], edx
mov edi, dword [esi + 0x2c]
mov ebp, dword [esi + 0x28]
push eax
push 0x102
add edi, esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [esp + 0x1c], eax
jne 0x4032b1
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x424
ret 0x10
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, eax
test edx, edx
mov dword [esp + 0x14], edx
jne 0x4032d2
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x424
ret 0x10
mov ecx, ebp
mov dword [esp + 0x2c], edx
sub ecx, ebx
add ecx, esi
mov eax, ecx
dec ecx
test eax, eax
je 0x403301
mov eax, ebx
sub eax, edx
inc ecx
mov dword [esp + 0x18], ecx
mov cl, byte [eax + edx]
mov byte [edx], cl
mov ecx, dword [esp + 0x18]
inc edx
dec ecx
mov dword [esp + 0x18], ecx
jne 0x4032ec
mov edx, dword [esp + 0x14]
mov eax, edx
sub eax, ebx
add eax, esi
add ebp, eax
cmp edi, esi
je 0x40333f
mov edx, dword [edi + 4]
mov ecx, ebp
mov eax, edx
dec edx
test eax, eax
je 0x40332a
mov eax, edi
sub eax, ebp
inc edx
lea ebx, [eax + 8]
mov al, byte [ebx + ecx]
mov byte [ecx], al
inc ecx
dec edx
jne 0x403321
mov edx, dword [edi]
mov ebx, dword [edi + 4]
mov ecx, esi
add ebp, ebx
add ecx, edx
mov edi, ecx
cmp edi, esi
jne 0x40330d
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov ebp, dword [esp + 0x28]
add eax, 0xfffffffc
add edx, 4
push eax
lea ecx, [esp + 0x34]
push edx
push ecx
push ebp
call fcn.00403070
mov edi, dword [esp + 0x2c]
add esp, 0x10
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test esi, esi
je 0x403385
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x424
ret 0x10
mov edx, dword [ebp + 0x3c]
mov ecx, dword [edx + ebp + 0x80]
lea eax, [edx + ebp + 0x18]
add ecx, ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], ecx
mov edi, dword [ecx + 0xc]
test edi, edi
je 0x40345f
mov ebx, dword [ecx]
mov esi, dword [ecx + 0x10]
mov eax, dword [edi + ebp]
add edi, ebp
add ebx, ebp
add esi, ebp
cmp eax, 0x62696c7a
mov dword [esp + 0x14], 0
jne 0x4033d5
cmp dword [edi + 4], 0x6c6c642e
jne 0x4033d5
mov edi, 1
jmp 0x4033fe
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
mov dword [esp + 0x18], eax
jne 0x4033fa
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
mov dword [esp + 0x18], eax
je 0x403443
mov edi, dword [esp + 0x14]
mov eax, dword [ebx]
test eax, eax
je 0x403443
test edi, edi
je 0x403410
mov dword [esi], fcn.00403070
jmp 0x403436
test eax, 0x80000000
je 0x403424
and eax, 0xffff
push eax
mov eax, dword [esp + 0x1c]
push eax
jmp 0x40342e
mov edx, dword [esp + 0x18]
lea ecx, [eax + ebp + 2]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi], eax
mov eax, dword [ebx + 4]
add ebx, 4
add esi, 4
test eax, eax
jne 0x403404
mov eax, dword [esp + 0x10]
add eax, 0x14
mov ecx, eax
mov dword [esp + 0x10], eax
mov edi, dword [ecx + 0xc]
test edi, edi
jne 0x4033a8
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x444]
mov edx, dword [esp + 0x440]
mov eax, dword [eax + 0x10]
push ecx
mov ecx, dword [esp + 0x440]
push edx
mov edx, dword [esp + 0x440]
push ecx
push edx
add eax, ebp
call eax
mov esi, dword [esp + 0x20]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x424
ret 0x10