Function at 0x401000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
mov ecx, 0x5a4d
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov dword [ebp - 8], eax
cmp word [ebx], cx
jne 0x40122a
cmp dword [eax], 0x4550
jne 0x40122a
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x40
push 0x3000
push dword [eax + 0x50]
push dword [eax + 0x34]
call edi
mov esi, eax
xor eax, eax
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], eax
test esi, esi
jne 0x401089
mov eax, dword [ebp - 8]
push 0x40
push 0x3000
push dword [eax + 0x50]
push esi
call edi
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
jne 0x401080
push str.Can_not_allocate_memory_for_PE_n
call fcn.00401400
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
sub eax, dword [ecx + 0x34]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
push dword [eax + 0x54]
push ebx
push esi
call fcn.004024a0
mov eax, dword [ebp - 8]
xor ecx, ecx
add esp, 0xc
xor ebx, ebx
movzx edi, word [eax + 0x14]
add edi, 0x2c
cmp cx, word [eax + 6]
jae 0x4010d9
add edi, eax
nop
push dword [edi - 4]
mov eax, dword [edi]
add eax, dword [ebp + 8]
push eax
mov eax, dword [edi - 8]
add eax, esi
push eax
call fcn.004024a0
mov eax, dword [ebp - 8]
lea edi, [edi + 0x28]
inc ebx
add esp, 0xc
movzx eax, word [eax + 6]
cmp ebx, eax
jl 0x4010b0
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x401152
cmp dword [eax + 0xa4], 0
mov edx, dword [ebp - 4]
je 0x401155
mov edi, dword [eax + 0xa0]
mov eax, dword [edi + edx]
add edi, edx
test eax, eax
je 0x401155
nop dword [eax + eax]
mov esi, dword [edi + 4]
add eax, edx
mov dword [ebp + 8], eax
sub esi, 8
shr esi, 1
lea eax, [edi + 4]
mov dword [ebp - 0xc], eax
mov edx, 0
je 0x401147
nop word [eax + eax]
movzx eax, word [edi + edx*2 + 8]
mov ecx, eax
and ecx, 0xf000
cmp ecx, 0x3000
jne 0x40113f
and eax, 0xfff
add eax, dword [ebp + 8]
add dword [eax], ebx
inc edx
cmp edx, esi
jb 0x401120
mov eax, dword [ebp - 0xc]
add edi, dword [eax]
mov edx, dword [ebp - 4]
mov eax, dword [edi]
test eax, eax
jne 0x401100
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
cmp dword [eax + 0x84], 0
je 0x4011d3
mov edi, dword [eax + 0x80]
add edi, edx
mov dword [ebp + 8], edi
cmp dword [edi + 0xc], 0
je 0x4011d3
mov esi, dword [edi + 0xc]
add esi, edx
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x4011f5
mov esi, dword [edi + 0x10]
mov edx, dword [ebp - 4]
add esi, edx
mov edi, dword [edi]
add edi, edx
cmp dword [esi], 0
je 0x4011c1
mov eax, dword [edi]
test eax, eax
jns 0x4011a0
movzx eax, ax
jmp 0x4011a5
add edx, 2
add eax, edx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4011e6
mov edx, dword [ebp - 4]
add edi, 4
mov dword [esi], eax
add esi, 4
cmp dword [esi], 0
jne 0x401195
mov edi, dword [ebp + 8]
add edi, 0x14
mov dword [ebp + 8], edi
cmp dword [edi + 0xc], 0
jne 0x401172
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
add eax, edx
call eax
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
push str.Error_loading_functions_n
call fcn.00401400
add esp, 4
jmp 0x401203
push esi
push str.Error_loading_lib:__s_n
call fcn.00401400
add esp, 8
push str.Error_loading_imports_n
call fcn.00401400
mov esi, dword [ebp - 4]
add esp, 4
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push str.Wrong_format_of_PE_file_n
call fcn.00401400
add esp, 4
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret