Function at 0x401c39
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file on windows

Disassembly:
push dword [esp + 4]
pop dword [0x40b2fa]
push ebp
mov ebp, esp
push dword [0x40b014]
push eax
push ebx
push ecx
push edx
push esi
push edi
mov dword [0x40bc41], 0
mov eax, dword [0x40b2fa]
and eax, 0x10
je 0x401c70
or dword [0x40b014], 0x400
push str.shell32.dll
call sub.KERNEL32.dll_LoadLibraryA
mov dword [0x40b2ea], 2
lea eax, [0x40b326]
mov dword [0x40b2ee], eax
mov dword [0x40bc41], 0x58
test dword [0x40b014], 0x20
jne 0x401cc2
push dword [0x40bc41]
push str.Error__d
push 0x40b753
call sub.USER32.dll_wsprintfA
add esp, 0xc
jmp 0x401f42
lea eax, [0x40c06b]
mov dword [0x40b00c], eax
mov dword [0x40c06b], 0x92
push str.KERNEL32.DLL
call sub.KERNEL32.dll_LoadLibraryA
cmp eax, 0
je 0x401cf6
push str.FindClose
push eax
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x40bb80], eax
call fcn.004025e6
mov dword [0x40bc41], 0x50
jb 0x401f08
cmp eax, 0
mov dword [0x40bc41], 0x51
jne 0x401d8f
cmp dword [0x40bb96], 1
jne 0x401d63
mov dword [0x40bc41], 0x51
push 0x40b753
push 0x40b54b
call sub.KERNEL32.dll_lstrcpy
push 0x40b447
push 0x40b54b
push dword [0x40bc41]
push str.Error__d_r_n_s__specified_in__s__was_not_found.
push 0x40b753
call sub.USER32.dll_wsprintfA
add esp, 0x14
jmp 0x401f42
mov dword [0x40bc41], 0x51
push 0x40b8bc
push dword [0x40bc41]
push str.Error__d_r_n_s_was_not_found.
push 0x40b753
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x401f42
push 0x40b54b
push 0x40b018
call sub.KERNEL32.dll_lstrcpy
push 0x40
push 0x3000
mov eax, dword [0x40b9ec]
add eax, 0x10000
push eax
push 0
call sub.KERNEL32.dll_VirtualAlloc
cmp eax, 0
jne 0x401dcb
mov dword [0x40bc41], 0x52
jmp 0x401f08
mov dword [0x40bb0a], eax
and eax, 0xffff0000
mov dword [0x40bb0e], eax
push 0
push 0
push 3
push 0
push 3
push closesocket
push 0x40b54b
call sub.KERNEL32.dll_CreateFileA
mov dword [0x40bb12], eax
cmp eax, 0xffffffff
jne 0x401e0c
mov dword [0x40bc41], 0x53
jmp 0x401ef6
push 0
push 0x40bb6a
push dword [0x40b9ec]
push dword [0x40bb0e]
push dword [0x40bb12]
call sub.KERNEL32.dll_ReadFile
cmp eax, 0
jne 0x401e3e
mov dword [0x40bc41], 0x54
jmp 0x401ef6
push dword [0x40bb12]
call sub.KERNEL32.dll_CloseHandle
test dword [0x40b014], 0x10000
je 0x401e69
call fcn.00402952
mov dword [0x40bc41], 0
jmp 0x401ef6
push str.KERNEL32.DLL
call sub.KERNEL32.dll_LoadLibraryA
cmp eax, 0
jne 0x401e84
mov dword [0x40bc41], 0x55
jmp 0x401ef6
mov dword [0x40bb2f], eax
push str.GetProcAddress
push eax
call sub.KERNEL32.dll_GetProcAddress
cmp eax, 0
jne 0x401ea5
mov dword [0x40bc41], 0x56
jmp 0x401ef6
mov dword [0x40b008], eax
push str.LoadLibraryA
push dword [0x40bb2f]
call sub.KERNEL32.dll_GetProcAddress
cmp eax, 0
jne 0x401ecb
mov dword [0x40bc41], 0x57
jmp 0x401ef6
mov dword [0x40b004], eax
mov eax, dword [0x40bb0e]
push section..data
add eax, dword [eax]
call eax
cmp eax, 0x2a3
jne 0x401eea
mov eax, 0
mov dword [0x40bc41], eax
mov byte [0x40bc45], 1
push 0x8000
push 0
push dword [0x40bb0a]
call sub.KERNEL32.dll_VirtualFree
cmp dword [0x40bc41], 0
je 0x401f61
push 0x40b54b
push 0x40b11d
push dword [0x40bc41]
push str.Error__d_s_accessing__s
push 0x40b753
call sub.USER32.dll_wsprintfA
add esp, 0x14
push str._r_nMore_details_can_be_found_at_www.copyminder.com_kb
push 0x40b753
call sub.KERNEL32.dll_lstrcat
test dword [0x40b014], 0x10
jne 0x401f61
push 0
push str.Error
push 0x40b753
push 0
call sub.USER32.dll_MessageBoxA
cmp byte [0x40bc45], 1
je 0x401f6a
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
push dword [0x40b014]
pop dword [0x40bb72]
pop dword [0x40b014]
pop ebp
mov eax, dword [0x40bc41]
cmp eax, 0x28f
je fcn.00401c24
mov al, byte [0x40c116]
cmp al, 0
mov eax, dword [0x40bc41]
je 0x401fbe
push eax
push ebx
push ecx
push edx
push esi
push edi
mov byte [0x40c116], 0
push 0x40c117
call sub.KERNEL32.dll_LeaveCriticalSection
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
ret 4