Function at 0x406680
Capabilities:
Allocate or change rwx memory
Check os version
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3e4
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 4], ebx
mov esi, ecx
cmp edi, 4
jne 0x4066ba
push dword [ebp + 0x1c]
mov eax, dword [ebp + 0x10]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
push dword [ebp + 0xc]
call fcn.0041ae30
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x210
lea eax, [ebp - 0x3d0]
mov dword [ebp - 0x3e0], 0
push 0
push eax
mov dword [ebp - 0x3dc], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
mov word [ebp - 0x1c0], ax
push 0x156
push eax
lea eax, [ebp - 0x1be]
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [0x459a10]
add esp, 0xc
mov dword [ebp - 0x58], eax
mov eax, dword [0x459a08]
mov dword [ebp - 0x54], eax
mov eax, dword [0x459a04]
mov dword [ebp - 0x50], eax
mov eax, dword [0x459a00]
mov dword [ebp - 0x4c], eax
mov eax, dword [0x4599e4]
mov dword [ebp - 0x48], eax
mov eax, dword [0x459a0c]
mov edx, dword [0x459a18]
mov dword [ebp - 0x44], eax
mov eax, dword [0x4599d0]
mov dword [ebp - 0x40], eax
mov eax, dword [0x4599cc]
mov dword [ebp - 0x3c], eax
mov eax, dword [0x4599bc]
mov dword [ebp - 0x38], eax
mov eax, dword [0x45999c]
mov dword [ebp - 0x34], eax
mov eax, dword [0x459990]
mov dword [ebp - 0x30], eax
mov eax, dword [0x459950]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x45997c]
mov dword [ebp - 0x28], eax
mov eax, dword [0x459988]
mov dword [ebp - 0x24], eax
mov eax, dword [0x459984]
mov dword [ebp - 0x20], eax
mov eax, dword [0x459978]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x3d8], eax
mov dword [ebp - 0x3d4], edi
test edx, edx
jne 0x4067ec
mov ecx, dword fs:[0x30]
test ecx, ecx
je 0x4067ec
mov edx, dword [ecx + 0xa8]
mov edi, dword [ecx + 0xa4]
cmp edx, 0xa
jb 0x4067d4
mov eax, 0xcccccccd
mul edx
shr edx, 3
cmp edx, 0xa
jae 0x4067c5
lea eax, [edi + edi*4]
lea edx, [edx + eax*2]
movzx eax, word [ecx + 0xac]
mov dword [0x459a18], edx
mov dword [0x459a14], eax
mov eax, dword [0x459a14]
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x64], eax
test esi, esi
je 0x4070aa
mov ecx, 0x104
mov eax, esi
cmp word [eax], 0
je 0x406814
add eax, 2
sub ecx, 1
jne 0x406806
xor edx, edx
mov eax, 0x80070057
test ecx, ecx
cmovne eax, edx
je 0x4070af
mov eax, 0x104
mov edx, 0x104
sub eax, ecx
add eax, eax
neg ecx
sbb ecx, ecx
and ecx, eax
mov eax, 0x208
mov word [ebp - 0x3d0], cx
lea ecx, [ebp - 0x3c8]
mov word [ebp - 0x3ce], ax
mov eax, ecx
sub esi, eax
nop word [eax + eax]
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x40687e
movzx eax, word [esi + ecx]
test ax, ax
je 0x40687e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x406860
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
test edx, edx
mov word [eax], cx
mov eax, 0x8007007a
cmovne eax, ecx
jne 0x406935
mov esi, dword [ebp + 0x1c]
push 0x208
push ecx
lea ebx, [esi + 4]
mov dword [esi], eax
push ebx
mov dword [esi + 0x414], 0x38
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esi + 0x20c]
mov dword [ebp + 8], eax
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 0xc
push 0x5c
push 0x448a98
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 8
add eax, 2
push eax
call edi
add eax, eax
push eax
push 0x5c
push 0x448a98
call esi
add esp, 8
add eax, 2
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.InjectDLL
call edi
add eax, eax
push eax
push str.InjectDLL
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memcpy
mov eax, 4
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, 0x43d5c0
mov eax, 0x440170
sub edx, section..inj_sec
sub eax, 0x43fe70
xor esi, esi
mov dword [ebp - 8], edx
test byte [ebp + 0x10], 4
push 0x40
cmovne esi, eax
lea eax, [edx + 0x3d8]
push 0x3000
push eax
push 0
push ebx
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
mov dword [ebp - 0x14], edi
lea eax, [edi + 0x3d7]
and eax, 0xfffffff0
mov dword [ebp - 0x10], eax
test edi, edi
jne 0x406a28
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 0x1c]
push 0x208
push edi
lea ebx, [esi + 4]
mov dword [esi], eax
push ebx
mov dword [esi + 0x414], 0x52
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esi + 0x20c]
mov dword [ebp + 8], eax
push 0x208
push edi
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 0xc
push 0x5c
push 0x448a98
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 8
add eax, 2
push eax
call edi
add eax, eax
push eax
push 0x5c
push 0x448a98
call esi
add esp, 8
add eax, 2
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.InjectDLL
call edi
add eax, eax
push eax
push str.InjectDLL
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memcpy
mov eax, 0x15
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x406b3a
push 0x40
push 0x3000
lea eax, [esi + 0x24]
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
mov dword [ebp + 8], esi
test esi, esi
jne 0x406b06
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 0x1c]
push 0x208
push 0
lea ebx, [esi + 4]
mov dword [esi], eax
push ebx
mov dword [esi + 0x414], 0x5f
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esi + 0x20c]
mov dword [ebp + 8], eax
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 0xc
push 0x5c
push 0x448a98
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 8
add eax, 2
push eax
call edi
add eax, eax
push eax
push 0x5c
push 0x448a98
call esi
add esp, 8
add eax, 2
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.InjectDLL
call edi
add eax, eax
push eax
push str.InjectDLL
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memcpy
mov esi, dword [ebp - 4]
add esp, 0xc
push 0x8000
push 0
push dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, 0x15
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
push edi
push str.pArg_________p_n
push 2
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x5c], eax
call fcn.0040e7c0
add esp, 0xc
push dword [ebp - 0x10]
push str.pShell_______p_n
push 2
call fcn.0040e7c0
add esp, 0xc
mov ecx, str.pVEHShell_____p_n
mov eax, esi
jmp 0x406b54
push edi
push str.pArg_________p_n
push 2
call fcn.0040e7c0
add esp, 0xc
mov ecx, str.pShell_______p_n
xor esi, esi
mov dword [ebp + 8], esi
push eax
push ecx
push 2
call fcn.0040e7c0
add esp, 0xc
lea eax, [ebp - 0x3e0]
push 0
push 0x3c8
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x406c10
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 0x1c]
push 0x208
push 0
lea ebx, [esi + 4]
mov dword [esi], eax
push ebx
mov dword [esi + 0x414], 0x78
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esi + 0x20c]
mov dword [ebp - 0xc], eax
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 0xc
push 0x5c
push 0x448a98
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 8
add eax, 2
push eax
call edi
add eax, eax
push eax
push 0x5c
push 0x448a98
call esi
add esp, 8
add eax, 2
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.InjectDLL
call edi
add eax, eax
push eax
push str.InjectDLL
push dword [ebp - 0xc]
jmp 0x406d6e
push 0
push dword [ebp - 8]
push section..inj_sec
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x406cbe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 0x1c]
push 0x208
push 0
lea ebx, [esi + 4]
mov dword [esi], eax
push ebx
mov dword [esi + 0x414], 0x88
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esi + 0x20c]
mov dword [ebp - 8], eax
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 0xc
push 0x5c
push 0x448a98
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 8
add eax, 2
push eax
call edi
add eax, eax
push eax
push 0x5c
push 0x448a98
call esi
add esp, 8
add eax, 2
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.InjectDLL
call edi
add eax, eax
push eax
push str.InjectDLL
push dword [ebp - 8]
jmp 0x406d6e
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x406daa
push 0
push eax
push 0x43fe70
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x406daa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 0x1c]
push 0x208
push 0
lea ebx, [esi + 4]
mov dword [esi], eax
push ebx
mov dword [esi + 0x414], 0x9c
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esi + 0x20c]
mov dword [ebp - 8], eax
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 0xc
push 0x5c
push 0x448a98
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 8
add eax, 2
push eax
call edi
add eax, eax
push eax
push 0x5c
push 0x448a98
call esi
add esp, 8
add eax, 2
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.InjectDLL
call edi
add eax, eax
push eax
push str.InjectDLL
push dword [ebp - 8]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 8]
add esp, 0xc
mov esi, dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test eax, eax
je 0x406d91
push 0x8000
push 0
push eax
push esi
call edi
push 0x8000
push 0
push dword [ebp - 0x14]
push esi
call edi
mov eax, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x10]
lea eax, [ebp - 0x18]
mov ecx, dword [ebp + 0x1c]
push ecx
push dword [ebp + 0x18]
mov ecx, edx
mov dword [ebp - 0x18], 0
or ecx, 0x3000
test dl, 8
push eax
cmove ecx, edx
mov edx, dword [ebp - 0x10]
push ecx
push dword [ebp + 0xc]
mov ecx, ebx
push edi
call fcn.0041ef40
add esp, 0x18
mov dword [ebp - 8], eax
test eax, eax
je 0x406e30
mov ecx, dword [ebp + 0xc]
cmp ecx, 3
je 0x407143
cmp ecx, 1
jne 0x406e02
cmp eax, 0x1020000a
je 0x407143
mov eax, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test esi, esi
je 0x406e1b
push 0x8000
push 0
push esi
push ebx
call eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
push edi
push ebx
call eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x3c8
lea eax, [ebp - 0x3e0]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x406f20
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 0x1c]
push 0x208
push 0
lea ebx, [esi + 4]
mov dword [esi], eax
push ebx
mov dword [esi + 0x414], 0xce
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esi + 0x20c]
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 0xc
push 0x5c
push 0x448a98
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 8
add eax, 2
push eax
call edi
add eax, eax
push eax
push 0x5c
push 0x448a98
call esi
add esp, 8
add eax, 2
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.InjectDLL
call edi
add eax, eax
push eax
mov eax, dword [ebp + 0x1c]
add eax, 0x20c
push str.InjectDLL
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp dword [ebp + 0xc], 3
je 0x406f14
mov eax, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov esi, dword [ebp - 4]
test eax, eax
je 0x406f07
push 0x8000
push 0
push eax
push esi
call edi
push 0x8000
push 0
push dword [ebp - 0x14]
push esi
call edi
mov eax, 0x1b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0xc], 3
je 0x406f35
push 0x8000
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
cmp dword [ebp - 0x18], 0
je 0x406fe1
mov esi, dword [ebp + 0x1c]
mov eax, dword [ebp - 0x3dc]
push 0x208
push 0
lea ebx, [esi + 4]
mov dword [esi], eax
push ebx
mov dword [esi + 0x414], 0xe6
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esi + 0x20c]
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 0xc
push 0x5c
push 0x448a98
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 8
add eax, 2
push eax
call edi
add eax, eax
push eax
push 0x5c
push 0x448a98
call esi
add esp, 8
add eax, 2
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.InjectDLL
call edi
add eax, eax
push eax
mov eax, dword [ebp + 0x1c]
add eax, 0x20c
push str.InjectDLL
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 0x18]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x3e0]
test ecx, ecx
jne 0x40708c
mov esi, dword [ebp + 0x1c]
push 0x208
push ecx
lea ebx, [esi + 4]
mov dword [esi], ecx
push ebx
mov dword [esi + 0x414], 0xef
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esi + 0x20c]
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 0xc
push 0x5c
push 0x448a98
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 8
add eax, 2
push eax
call edi
add eax, eax
push eax
push 0x5c
push 0x448a98
call esi
add esp, 8
add eax, 2
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.InjectDLL
call edi
add eax, eax
push eax
mov eax, dword [ebp + 0x1c]
add eax, 0x20c
push str.InjectDLL
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, 0x20
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
push ecx
push str.Imagebase___p_n
push 1
mov dword [eax], ecx
call fcn.0040e7c0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x80070057
mov esi, dword [ebp + 0x1c]
push 0x208
push 0
lea ebx, [esi + 4]
mov dword [esi], eax
push ebx
mov dword [esi + 0x414], 0x2b
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esi + 0x20c]
mov dword [ebp + 8], eax
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 0xc
push 0x5c
push 0x448a98
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 8
add eax, 2
push eax
call edi
add eax, eax
push eax
push 0x5c
push 0x448a98
call esi
add esp, 8
add eax, 2
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.InjectDLL
call edi
add eax, eax
push eax
push str.InjectDLL
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memcpy
mov eax, 4
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret