Function at 0x401140
Capabilities:
Execute shellcode via indirect call

Disassembly:
jmp 0x40ce70
push 0xffffffffffffffff
push 0x485a6c
mov eax, dword fs:[0]
push eax
mov eax, 0x10a4
call fcn.0041f740
mov eax, dword [0x4a7168]
xor eax, esp
mov dword [esp + 0x10a0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a7168]
xor eax, esp
push eax
lea eax, [esp + 0x10b8]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x10c8]
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0x18c], bl
je 0x40d377
cmp byte [esi + 0x7c], bl
lea edi, [esi + 0x7c]
je 0x40d377
push ebp
push edi
push str.SyringeDebugger::Run:_Running_process_to_debug._cmd____s__s_
call fcn.00401564
add esp, 0xc
push ebp
push edi
mov ecx, esi
call fcn.004011fe
test al, al
je 0x40d377
push str.SyringeDebugger::Run:_Allocating_0x1000_bytes_...
call fcn.00401564
mov eax, dword [esi + 4]
add esp, 4
push 0x40
push 0x3000
push 0x1000
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push eax
push str.SyringeDebugger::Run:_pAlloc__0x_08X
mov dword [esi + 0x188], eax
call fcn.00401564
add esp, 8
cmp dword [esi + 0x188], ebx
je 0x40d377
push str.SyringeDebugger::Run:_Filling_allocated_space_with_zero...
call fcn.00401564
push 0xffe
lea edx, [esp + 0xbe]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0xc4], cx
call fcn.0041d330
mov eax, dword [esi + 0x188]
mov edx, dword [esi + 4]
add esp, 0x10
push ebx
push 0x1000
lea ecx, [esp + 0xbc]
push ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push str.SyringeDebugger::Run:_Setting_addresses...
call fcn.00401564
mov eax, dword [esi + 0x188]
add eax, 0x100
lea edx, [eax + 8]
mov dword [esi + 0x1b0], edx
lea edx, [eax + 0xc]
lea ecx, [eax + 4]
lea edi, [esi + 0x1a8]
mov dword [esi + 0x1b4], edx
lea edx, [eax + 0x34]
mov dword [esi + 0x1a4], eax
mov dword [edi], eax
add eax, 0x104
lea ebp, [esi + 0x1bc]
push str.SyringeDebugger::Run:_Writing_DLL_loader__caller_code...
mov dword [esi + 0x1ac], ecx
mov dword [esi + 0x1b8], edx
mov dword [ebp], ecx
mov dword [esi + 0x1c0], eax
call fcn.00401564
mov eax, dword [esi + 0x188]
lea ecx, [eax + 1]
mov dword [esi + 0x1c4], ecx
mov cl, 0x15
mov dl, 0x90
add esp, 8
mov dword [esi + 0x1c8], eax
mov byte [esp + 0x84], dl
mov byte [esp + 0x85], 0x50
mov byte [esp + 0x86], 0x51
mov byte [esp + 0x87], 0x52
mov byte [esp + 0x88], 0x68
mov byte [esp + 0x89], bl
mov byte [esp + 0x8a], bl
mov byte [esp + 0x8b], bl
mov byte [esp + 0x8c], bl
mov byte [esp + 0x8d], 0xff
mov byte [esp + 0x8e], cl
mov byte [esp + 0x8f], bl
mov byte [esp + 0x90], bl
mov byte [esp + 0x91], bl
mov byte [esp + 0x92], bl
mov byte [esp + 0x93], 0x85
mov byte [esp + 0x94], 0xc0
mov byte [esp + 0x95], 0x74
mov byte [esp + 0x96], cl
mov byte [esp + 0x97], 0x68
mov byte [esp + 0x98], bl
mov byte [esp + 0x99], bl
mov byte [esp + 0x9a], bl
mov byte [esp + 0x9b], bl
mov byte [esp + 0x9c], 0x50
mov byte [esp + 0x9d], 0xff
mov byte [esp + 0x9e], cl
mov byte [esp + 0x9f], bl
mov byte [esp + 0xa0], bl
mov byte [esp + 0xa1], bl
mov byte [esp + 0xa2], bl
mov byte [esp + 0xa3], 0x85
mov byte [esp + 0xa4], 0xc0
mov byte [esp + 0xa5], dl
push ebx
push 0x2d
mov byte [esp + 0xae], dl
lea edx, [esp + 0x8c]
push edx
push eax
mov eax, dword [esi + 4]
push eax
mov byte [esp + 0xbb], 0xa3
mov byte [esp + 0xbc], bl
mov byte [esp + 0xbd], bl
mov byte [esp + 0xbe], bl
mov byte [esp + 0xbf], bl
mov byte [esp + 0xc0], 0x5a
mov byte [esp + 0xc1], 0x59
mov byte [esp + 0xc2], 0x58
mov byte [esp + 0xc3], 0xeb
mov byte [esp + 0xc4], 0xd3
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [esi + 0x1c8]
push 4
add ecx, 5
push ebp
push ecx
mov ecx, esi
call fcn.00401d4d
mov eax, dword [esi + 0x1c8]
push 4
lea edx, [esi + 0x180]
push edx
add eax, 0xb
push eax
mov ecx, esi
call fcn.00401d4d
mov ecx, dword [esi + 0x1c8]
push 4
lea eax, [esi + 0x1c0]
add ecx, 0x14
push eax
push ecx
mov ecx, esi
call fcn.00401d4d
mov eax, dword [esi + 0x1c8]
push 4
lea edx, [esi + 0x184]
push edx
add eax, 0x1b
push eax
mov ecx, esi
call fcn.00401d4d
mov ecx, dword [esi + 0x1c8]
push 4
add ecx, 0x24
push edi
push ecx
mov ecx, esi
call fcn.00401d4d
mov edx, dword [esi + 0x1c4]
push edx
push str.SyringeDebugger::Run:_pcLoadLibrary__0x_08X
call fcn.00401564
add esp, 8
lea eax, [esp + 0x78]
push eax
lea ecx, [esi + 0x5c]
mov byte [esi + 0x18d], bl
mov byte [esi + 0x18e], bl
call fcn.00401456
mov edi, eax
lea ebp, [esi + 0x70]
push edi
mov ecx, ebp
mov dword [esp + 0x10c4], ebx
call fcn.00401af0
mov ecx, dword [edi + 8]
mov dword [ebp + 8], ecx
lea ecx, [esp + 0x78]
mov dword [esp + 0x10c0], 0xffffffff
call fcn.004020bd
lea edi, [esi + 0x17c]
lea ebp, [esi + 0x1c]
push edi
mov ecx, ebp
call fcn.004016ef
mov byte [eax], bl
mov edx, dword [esi + 0x1c8]
lea eax, [esp + 0x14]
push eax
mov ecx, ebp
mov dword [esp + 0x18], edx
call fcn.004016ef
mov byte [eax], bl
mov ecx, dword [edi]
push ecx
mov ecx, esi
call fcn.00401fd2
mov edx, dword [esi + 0x1c8]
push edx
mov ecx, esi
call fcn.00401fd2
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push str.SyringeDebugger::Run:_Entering_debug_loop...
mov byte [esi + 0x194], bl
call fcn.00401564
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 4
jmp 0x40d2a0
push 0xffffffffffffffff
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
mov eax, dword [esp + 0x18]
dec eax
mov edi, 0x10002
cmp eax, 5
ja case.0x40d2bc.5
jmp dword [eax*4 + 0x40d3a4]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x2c]
mov dword [esi + 4], edx
lea edx, [esp + 0x20]
mov dword [esi + 0x10], ecx
mov ecx, dword [esi]
push edx
mov dword [esi + 8], eax
call fcn.00401578
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x20]
mov dword [eax], ecx
mov ecx, dword [esi]
push edx
call fcn.00401578
mov dword [eax + 4], ebx
mov eax, dword [esp + 0x24]
push eax
call ebp
cmp dword [esp + 0x18], 5
je 0x40d35b
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push edi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
jmp 0x40d2a0
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esi]
call fcn.00401578
mov edx, dword [esp + 0x24]
mov dword [eax], edx
mov ecx, dword [esi]
lea eax, [esp + 0x20]
push eax
call fcn.00401578
mov dword [eax + 4], ebx
jmp case.0x40d2bc.5
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esi]
call fcn.00401b8b
jmp case.0x40d2bc.5
lea edx, [esp + 0x18]
push edx
mov ecx, esi
call fcn.00401f3c
mov edi, eax
jmp case.0x40d2bc.5
mov eax, dword [esi + 4]
push eax
call ebp
push str.SyringeDebugger::Run:_Done.
call fcn.00401564
add esp, 4
call fcn.004010be
mov al, 1
jmp 0x40d379
xor al, al
mov ecx, dword [esp + 0x10b8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x10a0]
xor ecx, esp
call fcn.0041d320
add esp, 0x10b0
ret 4