Function at 0x402900
Capabilities:
Allocate or change rwx memory
Check os version
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x431540]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x11c
xor ebx, ebx
lea eax, [ebp - 0x168]
push ebx
push eax
call fcn.00415a10
add esp, 0xc
lea ecx, [ebp - 0x168]
push ecx
mov dword [ebp - 0x168], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x4029c5
cmp dword [0x433bdc], 1
jne 0x4029b2
push str.Failed_to_patch_CAPI._Windows_version_could_not_be_retrieved.
push 0x432ae8
call fcn.004059e0
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00407630
mov edx, dword [esi]
mov eax, dword [edx + 4]
add eax, esi
xor edi, edi
test byte [eax + 0xc], 6
jne 0x402993
mov eax, dword [eax + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x402993
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x4029b2
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x4029ab
or eax, 4
push ebx
push eax
call fcn.00407870
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413635
mov esp, ebp
pop ebp
ret
mov edx, dword [str.rsaenh.dll]
mov ecx, dword [0x42b480]
mov eax, dword [0x42b47c]
mov dword [ebp - 0x3c], edx
mov edx, dword [0x42b484]
mov dword [ebp - 0x30], edx
mov edx, dword [str.CPExportKey]
mov dword [ebp - 0x38], eax
mov eax, dword [0x42b488]
mov dword [ebp - 0x34], ecx
mov cx, word [0x42b48c]
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x2c], eax
mov eax, dword [0x42b494]
mov word [ebp - 0x28], cx
mov ecx, dword [0x42b498]
lea edx, [ebp - 0x3c]
push edx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x198], eax
cmp eax, ebx
jne 0x402ad3
cmp dword [0x433bdc], 1
jne 0x4029b2
push 0x42b49c
push ecx
lea eax, [ebp - 0x3c]
push eax
push ecx
push str.Failed_to_patch_CAPI._Unable_to_load_
push 0x432ae8
call fcn.004059e0
add esp, 0xc
push eax
call fcn.00405720
add esp, 0xc
push eax
call fcn.004059e0
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00407630
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add eax, esi
xor edi, edi
test byte [eax + 0xc], 6
jne 0x402a99
mov eax, dword [eax + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x402a99
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x4029b2
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x4029ab
or eax, 4
push ebx
push eax
call fcn.00407870
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413635
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x164], 6
mov dl, 0x85
mov dword [ebp - 0x17c], 0x75400108
mov dword [ebp - 0x178], 0x840f4009
mov byte [ebp - 0x16a], 0xeb
mov dword [ebp - 0xc], 0xf400108
mov byte [ebp - 8], dl
mov dword [ebp - 0x1c], 0x400108
mov word [ebp - 0x18], 0xf00
mov byte [ebp - 0x16], dl
mov dword [ebp - 0x14], 0xf400008
mov byte [ebp - 0x10], dl
mov dword [ebp - 0x24], 0x400008
mov word [ebp - 0x20], 0xf00
mov byte [ebp - 0x1e], dl
mov word [ebp - 0x170], 0xe990
mov dword [ebp - 0x180], ebx
mov dword [ebp - 0x184], ebx
jae 0x402b85
lea edx, [ebp - 0x16a]
mov dword [ebp - 0x174], edx
mov dword [ebp - 0x194], edx
mov edx, 1
mov ecx, 4
lea eax, [ebp - 0x17c]
lea edi, [ebp - 0x178]
mov dword [ebp - 0x188], edx
mov dword [ebp - 0x18c], edx
lea esi, [ecx - 9]
mov dword [ebp - 0x190], 0xfffffff9
jmp 0x402be3
cmp dword [ebp - 0x160], 1
lea eax, [ebp - 0x170]
mov ecx, eax
mov dword [ebp - 0x174], eax
mov eax, 2
mov dword [ebp - 0x194], ecx
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x18c], eax
jae 0x402bcb
mov esi, 3
lea eax, [ebp - 0xc]
mov ecx, 5
lea edi, [ebp - 0x14]
mov dword [ebp - 0x190], esi
jmp 0x402be3
mov ecx, 7
lea eax, [ebp - 0x1c]
lea edi, [ebp - 0x24]
mov dword [ebp - 0x190], 5
lea esi, [ecx - 2]
lea edx, [ebp - 0x48]
push edx
push esi
push ecx
push eax
lea eax, [ebp - 0x3c]
push eax
lea esi, [ebp - 0x180]
mov ebx, ecx
mov byte [ebp - 0x169], 0
call fcn.00411900
add esp, 0x14
test al, al
je 0x402e5b
mov edx, dword [ebp - 0x190]
lea ecx, [ebp - 0x48]
push ecx
push edx
push ebx
lea eax, [ebp - 0x3c]
push edi
push eax
lea esi, [ebp - 0x184]
call fcn.00411900
add esp, 0x14
test al, al
je 0x402e5b
mov edi, dword [ebp - 0x18c]
mov ebx, dword [ebp - 0x180]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 0x180]
push ecx
push 0x40
push edi
push ebx
mov byte [ebp - 0x169], 0
call esi
test eax, eax
je 0x402c8b
mov edx, dword [ebp - 0x194]
push edi
push edx
push edi
push ebx
call fcn.0041543d
mov ecx, dword [ebp - 0x180]
add esp, 0x10
test eax, eax
lea eax, [ebp - 0x18c]
push eax
push ecx
push edi
push ebx
sete byte [ebp - 0x169]
call esi
mov edi, dword [ebp - 0x188]
mov ebx, dword [ebp - 0x184]
lea edx, [ebp - 0x184]
push edx
push 0x40
push edi
push ebx
mov byte [ebp - 0x16b], 0
call esi
test eax, eax
je 0x402cdc
mov eax, dword [ebp - 0x174]
push edi
push eax
push edi
push ebx
call fcn.0041543d
mov edx, dword [ebp - 0x184]
add esp, 0x10
lea ecx, [ebp - 0x188]
push ecx
push edx
push edi
test eax, eax
push ebx
sete byte [ebp - 0x16b]
call esi
cmp dword [0x433bdc], 1
jne 0x402e52
cmp byte [ebp - 0x16b], 0
mov ebx, str.FAILED
mov dword [ebp - 0x174], 0x42b4c8
jne 0x402d07
mov dword [ebp - 0x174], ebx
cmp byte [ebp - 0x169], 0
je 0x402d15
mov ebx, 0x42b4c8
push str.Patterns_CRYPT_EXPORTABLE__CRYPT_ARCHIVABLE_and_CRYPT_ARCHIVABLE_found_
push 0x432b38
call fcn.00405720
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00407630
mov eax, dword [esi]
mov eax, dword [eax + 4]
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x402d57
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x402d57
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x402d78
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0x402d70
or eax, 4
push 0
push eax
call fcn.00407870
push ebx
push ecx
push str.Patch_CRYPT_EXPORTABLE__CRYPT_ARCHIVABLE:
push esi
call fcn.00405720
add esp, 0xc
push eax
call fcn.00405720
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00407630
mov edx, dword [esi]
mov eax, dword [edx + 4]
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x402dc1
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x402dc1
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x402de2
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0x402dda
or eax, 4
push 0
push eax
call fcn.00407870
mov edx, dword [ebp - 0x174]
push edx
push ecx
push str.Patch_CRYPT_ARCHIVABLE:
push esi
call fcn.00405720
add esp, 0xc
push eax
call fcn.00405720
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00407630
mov eax, dword [esi]
mov eax, dword [eax + 4]
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x402e31
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x402e31
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x402e52
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0x402e4a
or eax, 4
push 0
push eax
call fcn.00407870
mov byte [ebp - 0x169], 1
jmp 0x402ec7
cmp dword [0x433bdc], 1
jne 0x402ec7
push str.Warning:_Patterns_CRYPT_EXPORTABLE__CRYPT_ARCHIVABLE_and_CRYPT_ARCHIVABLE_not_found_
push 0x432ae8
call fcn.004059e0
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00407630
mov edx, dword [esi]
mov eax, dword [edx + 4]
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x402ea6
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x402ea6
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x402ec7
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0x402ebf
or eax, 4
push 0
push eax
call fcn.00407870
mov edx, dword [ebp - 0x198]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x169]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00413635
mov esp, ebp
pop ebp
ret