Function at 0x401c39
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file on windows

Disassembly:
push dword [esp + 4]
pop dword [0x40c2fa]
push ebp
mov ebp, esp
push dword [0x40c014]
push eax
push ebx
push ecx
push edx
push esi
push edi
mov dword [0x40cc41], 0
mov eax, dword [0x40c2fa]
and eax, 0x10
je 0x401c70
or dword [0x40c014], 0x400
or dword [0x40c014], 0x1000000
push str.shell32.dll
call sub.KERNEL32.dll_LoadLibraryA
mov dword [0x40c2ea], 2
lea eax, [0x40c326]
mov dword [0x40c2ee], eax
mov dword [0x40cc41], 0x58
test dword [0x40c014], 0x20
jne 0x401ccc
push dword [0x40cc41]
push str.Error__d
push 0x40c753
call sub.USER32.dll_wsprintfA
add esp, 0xc
jmp 0x401f6c
lea eax, [0x40d06b]
mov dword [0x40c00c], eax
mov dword [0x40d06b], 0x92
push str.KERNEL32.DLL
call sub.KERNEL32.dll_LoadLibraryA
cmp eax, 0
je 0x401d00
push str.FindClose
push eax
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x40cb80], eax
call fcn.004026f1
mov dword [0x40cc41], 0x50
jb 0x401f32
cmp eax, 0
mov dword [0x40cc41], 0x51
jne 0x401d99
cmp dword [0x40cb96], 1
jne 0x401d6d
mov dword [0x40cc41], 0x51
push 0x40c753
push 0x40c54b
call sub.KERNEL32.dll_lstrcpy
push 0x40c447
push 0x40c54b
push dword [0x40cc41]
push str.Error__d_r_n_s__specified_in__s__was_not_found.
push 0x40c753
call sub.USER32.dll_wsprintfA
add esp, 0x14
jmp 0x401f6c
mov dword [0x40cc41], 0x51
push 0x40c8bc
push dword [0x40cc41]
push str.Error__d_r_n_s_was_not_found.
push 0x40c753
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x401f6c
push 0x40c54b
push 0x40c018
call sub.KERNEL32.dll_lstrcpy
push 0x40
push 0x3000
mov eax, dword [0x40c9ec]
add eax, 0x10000
push eax
push 0
call sub.KERNEL32.dll_VirtualAlloc
cmp eax, 0
jne 0x401dd5
mov dword [0x40cc41], 0x52
jmp 0x401f32
mov dword [0x40cb0a], eax
and eax, 0xffff0000
mov dword [0x40cb0e], eax
push 0
push 0
push 3
push 0
push 3
push closesocket
push 0x40c54b
call sub.KERNEL32.dll_CreateFileA
mov dword [0x40cb12], eax
cmp eax, 0xffffffff
jne 0x401e16
mov dword [0x40cc41], 0x53
jmp 0x401f20
push 0
push 0x40cb6a
push dword [0x40c9ec]
push dword [0x40cb0e]
push dword [0x40cb12]
call sub.KERNEL32.dll_ReadFile
cmp eax, 0
jne 0x401e48
mov dword [0x40cc41], 0x54
jmp 0x401f20
push dword [0x40cb12]
call sub.KERNEL32.dll_CloseHandle
test dword [0x40c014], 0x10000
je 0x401e73
call fcn.00402a5d
mov dword [0x40cc41], 0
jmp 0x401f20
push str.KERNEL32.DLL
call sub.KERNEL32.dll_LoadLibraryA
cmp eax, 0
jne 0x401e91
mov dword [0x40cc41], 0x55
jmp 0x401f20
mov dword [0x40cb2f], eax
push str.GetProcAddress
push eax
call sub.KERNEL32.dll_GetProcAddress
cmp eax, 0
jne 0x401eb2
mov dword [0x40cc41], 0x56
jmp 0x401f20
mov dword [0x40c008], eax
push str.LoadLibraryA
push dword [0x40cb2f]
call sub.KERNEL32.dll_GetProcAddress
cmp eax, 0
jne 0x401ed8
mov dword [0x40cc41], 0x57
jmp 0x401f20
mov dword [0x40c004], eax
mov eax, dword [0x40cb0e]
push section..data
add eax, dword [eax]
call eax
cmp eax, 0x2a3
jne 0x401ef7
mov eax, 0
mov dword [0x40cc41], eax
cmp eax, 0
jne 0x401f19
mov ebx, dword [0x40c30e]
cmp ebx, dword [0x40d133]
je 0x401f19
cmp ebx, 0xffffffff
je 0x401f19
call fcn.00402a8e
mov byte [0x40cc45], 1
push 0x8000
push 0
push dword [0x40cb0a]
call sub.KERNEL32.dll_VirtualFree
cmp dword [0x40cc41], 0
je 0x401f8b
push 0x40c54b
push 0x40c11d
push dword [0x40cc41]
push str.Error__d_s_accessing__s
push 0x40c753
call sub.USER32.dll_wsprintfA
add esp, 0x14
push str._r_nMore_details_can_be_found_at_www.copyminder.com_kb
push 0x40c753
call sub.KERNEL32.dll_lstrcat
test dword [0x40c014], 0x10
jne 0x401f8b
push 0
push str.Error
push 0x40c753
push 0
call sub.USER32.dll_MessageBoxA
cmp byte [0x40cc45], 1
je 0x401f94
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
push dword [0x40c014]
pop dword [0x40cb72]
pop dword [0x40c014]
pop ebp
mov eax, dword [0x40cc41]
cmp eax, 0x28f
je fcn.00401c24
mov al, byte [0x40d116]
cmp al, 0
mov eax, dword [0x40cc41]
je 0x401fe8
push eax
push ebx
push ecx
push edx
push esi
push edi
mov byte [0x40d116], 0
push 0x40d117
call sub.KERNEL32.dll_LeaveCriticalSection
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
ret 4