Function at 0x402360
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x40b040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x40c3ac], 0
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x28], eax
jne 0x402393
xor edx, edx
lea ecx, [edx + 1]
call fcn.004012c0
mov dword [0x40c3ac], eax
push dword [ebx]
call fcn.00406c21
mov ecx, dword [ebx]
add esp, 4
cmp byte [0x40c388], 0
mov edx, dword [ebx + 4]
mov dword [ebx + 8], eax
je 0x4023bb
push ecx
push edx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x4023cc
push 0
push ecx
push eax
push edx
push dword [0x40c38c]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, dword [0x40c3ac]
mov al, dl
sub al, byte [ebx + 4]
mov edi, dword [ebx + 4]
sub al, 5
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
sub edx, edi
mov byte [ebp - 0xb], al
mov byte [ebp - 0xc], 0xe9
lea ecx, [edx - 5]
mov eax, ecx
sar ecx, 0x10
sar eax, 8
mov byte [ebp - 0xa], al
lea eax, [edx - 5]
shr eax, 0x18
cmp byte [0x40c388], 0
mov byte [ebp - 9], cl
mov byte [ebp - 8], al
je 0x402434
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 2
push eax
push 0x40
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0xc]
mov dword [edi], eax
mov al, byte [ebp - 8]
mov byte [edi + 4], al
jmp 0x402445
push 0
push 5
lea eax, [ebp - 0xc]
push eax
push edi
push dword [0x40c38c]
call esi
mov edi, 5
cmp dword [ebx], edi
jle 0x4024a4
nop
mov esi, dword [ebx + 4]
add esi, edi
mov byte [ebp - 0x1c], 0x90
cmp byte [0x40c388], 0
je 0x402488
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 2
push eax
push 0x40
push 0x400
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [ebp - 0x1c]
mov byte [esi], al
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x40249f
push 0
push 1
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [0x40c38c]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call esi
inc edi
cmp edi, dword [ebx]
jl 0x402450
mov al, byte [ebx + 4]
mov ecx, dword [ebp + 0xc]
sub al, cl
mov edx, dword [0x40c3ac]
sub al, dl
mov dword [ebp - 0x2c], edx
sub al, 7
mov edx, dword [ebx + 4]
mov edi, dword [ebp - 0x2c]
sub edx, edi
sub edx, ecx
mov byte [ebp - 0x13], al
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x18], 0x60
lea ecx, [edx - 7]
mov eax, ecx
sar ecx, 0x10
sar eax, 8
mov byte [ebp - 0x12], al
lea eax, [edx - 7]
shr eax, 0x18
cmp byte [0x40c388], 0
mov byte [ebp - 0x11], cl
mov byte [ebp - 0x10], al
je 0x402516
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 2
push eax
push 0x40
push 0x400
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call edi
mov ecx, dword [ebp - 0x2c]
mov al, byte [ebp - 0x18]
mov byte [ecx], al
jmp 0x40252d
push 0
push 1
lea eax, [ebp - 0x18]
push eax
push edi
push dword [0x40c38c]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x40c3ac]
inc eax
cmp byte [0x40c388], 0
mov dword [ebp - 0x24], eax
je 0x402567
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 2
push ecx
push 0x40
push 0x400
push eax
call edi
push dword [ebp + 0xc]
push dword [ebp - 0x28]
push dword [ebp - 0x24]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x402578
push 0
push dword [ebp + 0xc]
push dword [ebp - 0x28]
push eax
push dword [0x40c38c]
call esi
mov eax, dword [0x40c3ac]
inc eax
mov byte [ebp - 0x18], 0x61
add eax, dword [ebp + 0xc]
cmp byte [0x40c388], 0
mov dword [ebp - 0x24], eax
je 0x4025b0
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 2
push ecx
push 0x40
push 0x400
push eax
call edi
mov ecx, dword [ebp - 0x24]
mov al, byte [ebp - 0x18]
mov byte [ecx], al
jmp 0x4025c1
push 0
push 1
lea ecx, [ebp - 0x18]
push ecx
push eax
push dword [0x40c38c]
call esi
mov eax, dword [ebx + 8]
mov edx, dword [ebx]
mov dword [ebp - 0x28], eax
mov eax, dword [0x40c3ac]
add eax, 2
mov dword [ebp - 0x24], edx
add eax, dword [ebp + 0xc]
cmp byte [0x40c388], 0
mov dword [ebp - 0x2c], eax
je 0x40260b
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 2
push ecx
push 0x40
push 0x400
push eax
call edi
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x40261a
push 0
push edx
push dword [ebp - 0x28]
push eax
push dword [0x40c38c]
call esi
mov eax, dword [ebx]
mov ecx, dword [ebp + 0xc]
add eax, dword [0x40c3ac]
add ecx, 2
add eax, ecx
cmp byte [0x40c388], 0
mov dword [ebp - 0x24], eax
je 0x40265b
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 2
push ecx
push 0x40
push 0x400
push eax
call edi
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov dword [ecx], eax
mov al, byte [ebp - 0x10]
mov byte [ecx + 4], al
jmp 0x40266c
push 0
push 5
lea ecx, [ebp - 0x14]
push ecx
push eax
push dword [0x40c38c]
call esi
mov ecx, dword [ebx]
add ecx, dword [ebp + 0xc]
mov eax, dword [0x40c3ac]
add eax, 0x10
add eax, ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov dword [0x40c3ac], eax
pop ebx
call fcn.00406bb2
mov esp, ebp
pop ebp
ret 8