Function at 0x406790
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
push edi
mov edi, dword [esp + 0x10]
push 0x40
push 0x3000
push 0x1000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [0x460f48], eax
mov eax, dword [0x462754]
push str.SetEnvironmentVariableA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x462778], eax
jne 0x40686d
mov edx, dword [0x45fb58]
mov ecx, dword [0x45fbac]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0x462620
push eax
push 0x1007
push edx
mov dword [0x462634], 0x449f88
mov dword [0x462624], ecx
call esi
mov eax, dword [0x45fbac]
push 0x462620
add eax, 1
push 0
mov dword [0x45fbac], eax
mov dword [0x462624], eax
mov eax, dword [0x45fb58]
push 0x1007
push eax
mov dword [0x462634], 0x449fac
call esi
mov eax, dword [0x45fbac]
mov ecx, dword [0x45fb58]
push 0x462620
push 0
add eax, 1
push 0x1007
push ecx
mov dword [0x45fbac], eax
mov dword [0x462634], 0x449fd0
mov dword [0x462624], eax
call esi
add dword [0x45fbac], 1
pop edi
xor eax, eax
pop esi
pop ecx
ret
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0x460f20
push 0x10
mov dword [0x460ef4], eax
mov eax, dword [0x460f48]
push str.ArmServerInfo
push eax
push edi
mov dword [0x460f14], eax
call ebp
mov eax, dword [0x460f14]
push 0x460f20
push 0x10
mov dword [0x462738], eax
add eax, 0x10
push str.MyServer
push eax
push edi
mov dword [0x460f14], eax
call ebp
mov eax, dword [0x460f14]
push 0x460f20
push 0x10
mov dword [0x46273c], eax
add eax, 0x10
push str.ALTUSERNAME
push eax
push edi
mov dword [0x460f14], eax
call ebp
mov eax, dword [0x460f14]
push 0x460f20
push 0x10
mov dword [0x462740], eax
add eax, 0x10
push str.Armageddon
push eax
push edi
mov dword [0x460f14], eax
call ebp
mov eax, dword [0x460f14]
push 0x460f20
push 0x10
mov dword [0x462744], eax
add eax, 0x10
push str.USERKEY
push eax
push edi
mov dword [0x460f14], eax
call ebp
mov eax, dword [0x460f14]
push 0x460f20
push 0x2a
mov dword [0x462748], eax
add eax, 0x10
push str.XXXXXX_XXXXXX_XXXXXX_XXXXXX_XXXXXX_XXXXXX
push eax
push edi
mov dword [0x460f14], eax
call ebp
mov eax, dword [0x460f14]
mov dword [0x46274c], eax
add eax, 0x2a
xor esi, esi
mov dword [0x460f14], eax
mov dword [0x462750], eax
mov dword [0x461554], esi
mov ebx, 0x462090
push 0x100
push 0
push 0x461e90
call fcn.00415c90
push 0x100
push 0
push 0x461f90
call fcn.00415c90
xor eax, eax
add esp, 0x18
cmp esi, 0xd
mov dword [0x462090], eax
mov dword [0x462094], eax
mov dword [0x462098], eax
mov dword [0x46209c], eax
ja case.default.0x4069a6
jmp dword [esi*4 + 0x406e24]
push 0x44a000
push 0x461e90
call fcn.00415641
mov edx, dword [0x46273c]
push edx
push 0x44a008
push 0x461f90
call fcn.00415641
add esp, 0x14
jmp case.default.0x4069a6
push 0x44a010
push 0x461e90
call fcn.00415641
mov eax, dword [0x462738]
push eax
push 0x44a018
push 0x461f90
call fcn.00415641
add esp, 0x14
jmp case.default.0x4069a6
push 0x44a020
push 0x461e90
call fcn.00415641
mov ecx, dword [0x460ef4]
push ecx
push 0x44a024
push 0x461f90
call fcn.00415641
add esp, 0x14
jmp case.default.0x4069a6
push 0x44a030
push 0x461e90
call fcn.00415641
push 0x44a038
push 0x461f90
call fcn.00415641
add esp, 0x10
jmp case.default.0x4069a6
push 0x44a03c
push 0x461e90
call fcn.00415641
mov edx, dword [0x462744]
push edx
push 0x44a044
push 0x461f90
call fcn.00415641
add esp, 0x14
jmp case.default.0x4069a6
push 0x44a04c
push 0x461e90
call fcn.00415641
mov eax, dword [0x462740]
push eax
push 0x44a054
push 0x461f90
call fcn.00415641
add esp, 0x14
jmp case.default.0x4069a6
push 0x44a05c
push 0x461e90
call fcn.00415641
mov ecx, dword [0x460ef4]
push ecx
push 0x44a060
push 0x461f90
call fcn.00415641
add esp, 0x14
jmp case.default.0x4069a6
push 0x44a06c
push 0x461e90
call fcn.00415641
push 0x44a074
push 0x461f90
call fcn.00415641
add esp, 0x10
jmp case.default.0x4069a6
push 0x44a078
push 0x461e90
call fcn.00415641
mov edx, dword [0x46274c]
push edx
push 0x44a080
push 0x461f90
call fcn.00415641
add esp, 0x14
jmp case.default.0x4069a6
push 0x44a088
push 0x461e90
call fcn.00415641
mov eax, dword [0x462748]
push eax
push 0x44a090
push 0x461f90
call fcn.00415641
add esp, 0x14
jmp case.default.0x4069a6
push 0x44a098
push 0x461e90
call fcn.00415641
mov ecx, dword [0x460ef4]
push ecx
push 0x44a09c
push 0x461f90
call fcn.00415641
add esp, 0x14
jmp case.default.0x4069a6
push 0x44a0a8
push 0x461e90
call fcn.00415641
push 0x44a0b0
push 0x461f90
call fcn.00415641
add esp, 0x10
jmp case.default.0x4069a6
push 0x44a0b4
push 0x461e90
call fcn.00415641
mov edx, dword [0x460ebc]
push edx
push 0x44a0bc
push 0x461f90
call fcn.00415641
add esp, 0x14
jmp case.default.0x4069a6
push 0x44a0c4
push 0x461e90
call fcn.00415641
add esp, 8
mov eax, 0x461f90
mov dword [0x4535c4], 0
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x406c00
sub eax, edx
je 0x406cf1
push 0x461f90
push 0x461e90
push 0x44a0cc
push ebx
call fcn.00415641
push 0x30
push 0
push 0x461b28
mov dword [0x461b24], ebx
call fcn.00415c90
mov eax, dword [0x460f14]
add esp, 0x1c
push 0x4620a0
push 0
push 0
push 0x461b28
push eax
push ebx
mov dword [0x4535c4], 0
call dword [sym.imp.disasm.dll__Assemble_24]
test eax, eax
mov dword [0x4535c4], eax
jle 0x406d2e
mov ecx, dword [0x460f14]
push 0x460f20
push eax
push 0x461b28
push ecx
push edi
call ebp
mov esi, dword [0x461554]
mov edx, dword [0x4535c4]
add dword [0x460f14], edx
add esi, 1
cmp esi, 0xe
mov dword [0x461554], esi
jb 0x406962
mov ecx, dword [0x462750]
mov esi, dword [esp + 0x1c]
push 0x462210
push esi
mov dword [0x460f14], ecx
mov dword [0x462210], 0x10007
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov edx, dword [0x460f14]
push 0x462210
push esi
mov dword [0x4622c8], edx
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
pop ecx
ret
push 0x461e90
push 0x44a0d4
push ebx
call fcn.00415641
push 0x30
push 0
push 0x461b28
mov dword [0x461b24], ebx
call fcn.00415c90
mov eax, 1
add esp, 0x18
mov byte [0x461b28], 0xc3
mov dword [0x4535c4], eax
jmp 0x406c6f
push 0x50
push 0
mov edi, 0x45fbb0
push edi
call fcn.00415c90
push 0x4620a0
push 0x44a0d8
push edi
call fcn.00415641
mov ecx, dword [0x45fb58]
mov eax, dword [0x45fbac]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
add esp, 0x18
push 0x462620
push 0
push 0x1007
push ecx
mov dword [0x462634], edi
mov dword [0x462624], eax
call esi
push 0x50
push 0
mov ebx, 1
add dword [0x45fbac], ebx
push edi
call fcn.00415c90
mov edx, dword [0x460f14]
push edx
push 0x44a0e4
push edi
call fcn.00415641
mov ecx, dword [0x45fb58]
mov eax, dword [0x45fbac]
add esp, 0x18
push 0x462620
push 0
push 0x1007
push ecx
mov dword [0x462634], edi
mov dword [0x462624], eax
call esi
add dword [0x45fbac], ebx
push 0x50
push 0
push edi
call fcn.00415c90
push 0x461b28
push 0x44a0f4
push edi
call fcn.00415641
mov eax, dword [0x45fb58]
mov edx, dword [0x45fbac]
add esp, 0x18
push 0x462620
push 0
push 0x1007
push eax
mov dword [0x462634], edi
mov dword [0x462624], edx
call esi
add dword [0x45fbac], ebx
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
pop ecx
ret