Function at 0x40a9c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
lea ecx, [edx*4]
push edi
push esi
mov esi, eax
push ebx
lea ebx, [eax + 0x378]
sub esp, 0x5c
mov edi, dword [ebx*4 + 0x42d788]
mov dword [esp + 0x2c], edx
add edx, ecx
shl edx, 2
mov dword [esp + 0x30], ecx
mov ecx, dword [edx + 0x422040]
lea eax, [edx + 0x422040]
mov dword [esp + 0x28], edi
lea edx, [edi*4]
mov dword [esp + 0x24], edx
lea edi, [edi*8]
add edx, ecx
mov dword [esp + 0x20], edi
mov ebp, dword [edx]
test ebp, ebp
je 0x40aa40
mov eax, dword [ebp]
mov dword [edx], eax
mov eax, dword [esp + 0x20]
mov dword [ebp], 0
add dword [0x42d7a4], eax
add esp, 0x5c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [esp + 0x28]
test edi, edi
je 0x40ab80
mov eax, dword [eax + 4]
test eax, eax
je 0x40acbc
mov dword [esp + 0x34], edx
xor eax, eax
mov esi, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], 0
shl esi, 3
mov dword [esp + 0x44], 0
mov dword [esp + 0x20], esi
mov esi, dword [esp + 0x30]
mov dword [esp + 0x48], ebp
lea ecx, [esi + ebx]
lea esi, [ecx*4]
mov dword [esp + 0x38], esi
test eax, eax
jne 0x40ab66
mov edi, dword [0x42d534]
test edi, edi
je 0x40aac2
cmp dword [0x422034], 0xf423f
je 0x40aac2
mov esi, dword [0x42d530]
test esi, esi
je 0x40ae30
mov eax, dword [esp + 0x38]
mov ebp, dword [esp + 0x24]
mov esi, dword [eax + 0x422044]
add ebp, dword [eax + 0x422040]
test esi, esi
je 0x40aefd
mov eax, dword [esp + 0x24]
mov dword [esp + 0x1c], ebp
add esi, eax
jmp 0x40ab52
mov edx, eax
shr edx, 0x16
mov ecx, dword [edx*4 + 0x449174]
mov edx, eax
shr edx, 0xc
and edx, 0x3ff
mov edx, dword [ecx + edx*4]
mov ecx, dword [edx]
mov dword [esi], ecx
movzx ebx, byte [edx + 0xc]
mov ecx, dword [edx + 0x10]
lea edi, [ebx + ebx*4]
mov ebx, dword [edi*4 + 0x422040]
mov ebp, ecx
shr ebp, 3
lea ebx, [ebx + ebp*4]
mov ebp, dword [0x42d544]
mov word [edx + 0xe], bp
mov ebp, dword [ebx]
mov dword [esp + 4], ebp
mov edi, dword [edi*4 + 0x422050]
mov dword [esp], edi
call fcn.0040cdb0
mov dword [ebx], eax
mov eax, dword [esp + 0x1c]
mov ebx, dword [eax]
test ebx, ebx
jne 0x40ab58
mov eax, dword [esi]
test eax, eax
jne 0x40aaf0
mov eax, dword [esp + 0x34]
mov eax, dword [eax]
test eax, eax
je 0x40aefd
mov dword [0x42d0b8], 0
mov edx, dword [esp + 0x3c]
mov ebp, eax
jmp 0x40aa18
mov edi, dword [0x42d0a4]
test edi, edi
je 0x40ade2
mov edi, dword [0x42d764]
mov eax, 0xfffffff8
sub eax, edi
mov dword [esp + 0x1c], edi
mov edx, eax
cmp esi, eax
jae 0x40b3e3
lea eax, [edi + esi + 7]
mov esi, eax
and eax, 0xfffffff8
shr esi, 3
mov edi, eax
sub eax, esi
cmp dword [eax*4 + 0x42e568], 0
jne 0x40b0e8
mov eax, edi
shr eax, 2
sub edi, eax
mov eax, dword [edi*4 + 0x42e568]
test eax, eax
je 0x40abee
lea esi, [esi]
add edi, 1
mov eax, dword [edi*4 + 0x42e568]
test eax, eax
jne 0x40abe0
lea eax, [esi + 1]
and eax, 0xfffffffe
mov esi, eax
mov eax, 0x100
cmp esi, eax
cmovbe eax, esi
mov esi, 0x200
mov edx, eax
mov eax, esi
mov dword [esp + 0x20], edx
xor edx, edx
div dword [esp + 0x20]
xor edx, edx
mov dword [esp + 0x20], eax
mov eax, esi
div dword [esp + 0x20]
and eax, 0xfffffffe
lea edx, [eax*8]
mov esi, edx
mov edx, dword [esp + 0x1c]
sub esi, edx
cmp esi, edi
jb 0x40ac75
mov edx, esi
mov dword [edi*4 + 0x42e568], eax
sub edx, edi
add edi, 1
and edx, 1
cmp esi, edi
jb 0x40ac75
test edx, edx
je 0x40ac60
mov dword [edi*4 + 0x42e568], eax
add edi, 1
cmp esi, edi
jb 0x40ac75
lea esi, [esi]
mov dword [edi*4 + 0x42e568], eax
mov dword [edi*4 + 0x42e56c], eax
add edi, 2
cmp esi, edi
jae 0x40ac60
mov eax, dword [ebx*4 + 0x42d788]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
shl eax, 2
lea edx, [ecx + eax]
mov dword [esp + 0x24], eax
mov eax, dword [edx]
test eax, eax
je 0x40acaa
mov ebp, eax
mov eax, dword [esp + 0x28]
lea eax, [eax*8]
mov dword [esp + 0x20], eax
jmp 0x40aa18
imul eax, dword [esp + 0x2c], 0x14
cmp dword [eax + 0x422044], 0
jne 0x40adb6
mov ebx, dword [0x42d7c0]
mov eax, dword [0x42d7c8]
sub eax, ebx
cmp eax, 0x407
ja 0x40b4b1
mov ecx, dword [0x42d75c]
mov dword [esp + 0x1c], edx
test ecx, ecx
je 0x40ae60
mov dword [esp + 4], 0x11000
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
sub esp, 8
lea ebx, [eax + 0xfff]
mov edx, dword [esp + 0x1c]
and ebx, 0xfffff000
cmp dword [0x42d80c], 0x1ff
jbe 0x40ad34
mov dword [esp], 0x425225
mov dword [esp + 0x1c], edx
call fcn.004020f0
call dword [sym.imp.KERNEL32.dll_DebugBreak]
mov edx, dword [esp + 0x1c]
test ebx, ebx
je 0x40b03e
mov eax, dword [0x42d80c]
add dword [0x42d7a0], 0x10000
lea ecx, [eax + 1]
cmp dword [0x42d760], 2
mov dword [0x42d80c], ecx
mov dword [eax*4 + 0x441974], ebx
je 0x40b248
lea eax, [ebx + 0x10000]
mov dword [0x42d7c8], eax
lea eax, [ebx + 0x408]
mov dword [0x42d7c0], eax
lea edi, [ebx + 4]
mov ecx, ebx
xor eax, eax
mov dword [ebx], 0
mov dword [ebx + 0x400], 0
and edi, 0xfffffffc
sub ecx, edi
add ecx, 0x404
shr ecx, 2
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
add eax, esi
mov dword [eax*4 + 0x422044], ebx
mov eax, dword [esp + 0x28]
test eax, eax
je 0x40aa2e
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
add eax, esi
mov esi, dword [esp + 0x24]
add esi, dword [eax*4 + 0x422040]
mov dword [esp + 0x34], esi
mov eax, dword [esi]
jmp 0x40aa5d
mov ecx, dword [0x42d53c]
test ecx, ecx
jne 0x40b269
call fcn.00409c80
mov eax, dword [0x42d53c]
test eax, eax
jne 0x40b3f7
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov edi, dword [ebx*4 + 0x42d788]
add eax, ecx
mov dword [esp + 0x28], edi
mov ecx, dword [eax*4 + 0x422040]
test edi, edi
jne 0x40ac80
jmp 0x40ab8e
mov eax, 1
call fcn.004088f0
mov eax, dword [esp + 0x38]
mov esi, dword [eax + 0x422044]
test esi, esi
je 0x40ab58
mov eax, dword [esp + 0x38]
mov ebp, dword [esp + 0x24]
add ebp, dword [eax + 0x422040]
jmp 0x40aade
mov edx, dword [0x422180]
mov ecx, 0x40
mov eax, 4
mov dword [esp], 0
test edx, edx
cmovne eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [0x42d758]
or ah, 0x30
cmp dword [0x42d754], 1
mov dword [esp + 8], eax
mov eax, 0x10000
adc eax, 0
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub esp, 0x10
test eax, 0xfff
mov ebx, eax
mov edx, dword [esp + 0x1c]
je 0x40ad0e
mov dword [esp], 0x42520d
call fcn.004020f0
mov esi, dword [sym.imp.KERNEL32.dll_DebugBreak]
call esi
mov eax, dword [0x42d80c]
mov edx, dword [esp + 0x1c]
cmp eax, 0x1ff
jbe 0x40ad41
mov dword [esp], 0x425225
call fcn.004020f0
call esi
mov eax, dword [0x42d80c]
mov edx, dword [esp + 0x1c]
jmp 0x40ad41
cmp dword [esp + 0x20], 0xffffefff
ja 0x40affb
mov eax, dword [esp + 0x20]
lea edx, [eax + 0xfff]
mov eax, edx
and edx, 0xfffff000
shr eax, 0xc
cmp edx, 0x7ffffffe
ja 0x40affb
mov esi, eax
cmp eax, 0x20
jbe 0x40af48
mov esi, 0x3c
cmp eax, 0xff
ja 0x40af48
sub eax, 0x20
sar eax, 3
lea esi, [eax + 0x20]
mov dword [esp], 0
mov edx, dword [esp + 0x2c]
mov ecx, esi
mov eax, dword [esp + 0x20]
call fcn.0040c810
mov ebx, eax
test eax, eax
je 0x40b074
cmp dword [esp + 0x2c], 2
je 0x40b2a5
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov ebp, dword [esp + 0x24]
add eax, esi
add ebp, dword [eax*4 + 0x422040]
mov ecx, dword [eax*4 + 0x422050]
mov eax, dword [esp + 0x28]
mov esi, dword [ebp]
lea edx, [eax + eax]
mov dword [esp + 0x1c], esi
cmp edx, 2
je 0x40b1c4
cmp edx, 4
je 0x40b132
test ecx, ecx
jne 0x40b3b7
lea ecx, [edx*4]
mov esi, ebx
mov eax, ebx
sub esi, ecx
lea edx, [ebx + ecx]
lea edi, [esi + 0x1000]
cmp edi, edx
jb 0x40afe4
mov esi, ebx
lea esi, cs:[esi]
mov dword [edx], esi
mov eax, edx
add edx, ecx
add esi, ecx
cmp edi, edx
jae 0x40afd8
mov esi, dword [esp + 0x1c]
mov dword [ebx], esi
mov dword [ebp], eax
mov eax, dword [esp + 0x34]
mov eax, dword [eax]
test eax, eax
jne 0x40ab66
mov ecx, dword [0x42d534]
test ecx, ecx
je 0x40b015
cmp dword [0x422034], 0xf423f
je 0x40b416
mov edx, dword [esp + 0x40]
mov eax, 1
call fcn.0040cfc0
test eax, eax
je 0x40b4a1
mov dword [esp + 0x40], 1
mov eax, dword [esp + 0x34]
mov eax, dword [eax]
jmp 0x40aa96
mov dword [esp + 0x1c], edx
mov dword [esp + 4], 0x408
mov dword [esp], 0x425254
call dword [0x422184]
mov eax, 0x408
call fcn.00402f30
mov edx, dword [esp + 0x1c]
mov ebx, eax
test ebx, ebx
jne 0x40ad7e
jmp 0x40aa2e
mov edx, dword [0x42d530]
test edx, edx
jne 0x40b09e
mov eax, dword [0x42d780]
sub eax, dword [0x42d790]
cmp eax, dword [0x42d784]
jb 0x40b09e
mov eax, dword [0x42d534]
test eax, eax
je 0x40b43d
cmp esi, 0x1f
jle 0x40b290
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x20]
mov edi, 0x3c
jmp 0x40b0cb
add esi, 1
cmp esi, edi
jg 0x40afed
mov dword [esp], 0
mov ecx, esi
mov edx, ebx
mov eax, ebp
call fcn.0040c2c0
test eax, eax
je 0x40b0c0
mov ebx, eax
jmp 0x40af68
lea edi, [eax + 1]
mov eax, dword [eax*4 + 0x42e56c]
test eax, eax
je 0x40b10e
lea esi, cs:[esi]
nop
add edi, 1
mov eax, dword [edi*4 + 0x42e568]
test eax, eax
jne 0x40b100
cmp edi, edx
jae 0x40b40c
mov eax, dword [esp + 0x1c]
lea eax, [eax + edi + 7]
shr eax, 3
mov edx, eax
shr edx, 3
add edx, eax
cmp esi, edx
cmovb esi, edx
jmp 0x40abee
mov eax, dword [esp + 0x1c]
lea esi, [ebx + 0x1000]
mov dword [ebx], eax
test ecx, ecx
je 0x40b365
lea ecx, [ebx + 0x10]
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
cmp ecx, esi
jae 0x40b4aa
lea edi, [ebx + 0x20]
cmp esi, edi
sbb eax, eax
add ebx, 0x110
and al, 2
add eax, 0xff
lea esi, [esi]
mov dword [ebx - 0xfc], 0
lea edx, [ebx - 0x110]
add ebx, 0x10
mov dword [ebx - 0x110], edx
mov dword [ebx - 0x108], 0
mov dword [ebx - 0x104], 0
sub eax, 1
jne 0x40b180
cmp esi, edi
sbb eax, eax
not eax
and eax, 0xfe0
add eax, ecx
jmp 0x40afea
mov edi, dword [esp + 0x1c]
lea eax, [ebx + 0x10]
lea esi, [ebx + 0x1000]
mov dword [esp + 0x4c], eax
mov dword [ebx], edi
test ecx, ecx
je 0x40b327
mov dword [ebx + 4], 0
mov dword [ebx + 8], ebx
mov dword [ebx + 0xc], 0
cmp eax, esi
jae 0x40b240
lea edi, [ebx + 0x20]
cmp esi, edi
sbb edx, edx
and dl, 2
lea ecx, [edx + 0x100]
shl ecx, 4
add ecx, ebx
lea esi, [esi]
lea edx, [eax - 8]
mov dword [eax + 4], 0
mov dword [eax], edx
mov dword [eax + 8], eax
add eax, 0x10
mov dword [eax - 4], 0
cmp eax, ecx
jne 0x40b210
cmp esi, edi
mov esi, dword [esp + 0x4c]
sbb eax, eax
not eax
and eax, 0xfe0
lea eax, [esi + eax + 0x10]
sub eax, 8
jmp 0x40afea
mov dword [esp + 4], 0x10000
mov dword [esp], 0x42523c
mov dword [esp + 0x1c], edx
call fcn.00402d00
mov edx, dword [esp + 0x1c]
jmp 0x40ad68
mov dword [esp], 0x42d08c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [0x42d0a4]
sub esp, 4
test edx, edx
jne 0x40adf5
jmp 0x40adf0
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x20]
add esi, 1
mov edi, 0x3c
jmp 0x40b0cb
mov eax, ebx
shr eax, 0x16
mov edx, dword [eax*4 + 0x449174]
mov eax, ebx
shr eax, 0xc
and eax, 0x3ff
mov esi, dword [edx + eax*4]
mov eax, 0x1000
xor edx, edx
mov ecx, dword [esi + 0x10]
div ecx
mov edi, eax
cmp ecx, 0x800
ja 0x40b3a8
imul ecx, eax
mov eax, 1
mov edx, ecx
shr ecx, 3
shl eax, cl
lea ecx, [eax + eax - 2]
or ecx, 1
shr edx, 8
mov ebp, edx
je 0x40b31b
lea eax, [ebp*4]
mov dword [esp + 4], 0xff
mov dword [esp + 8], eax
lea eax, [esi + 0x20]
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call sub.msvcrt.dll_memset
mov ecx, dword [esp + 0x1c]
mov dword [esi + ebp*4 + 0x20], ecx
mov dword [esi + 0x1c], edi
jmp 0x40af73
mov dword [ebx + 8], ebx
cmp eax, esi
jae 0x40b240
lea edi, [ebx + 0x20]
cmp esi, edi
sbb edx, edx
and dl, 2
lea ecx, [edx + 0x100]
shl ecx, 4
add ecx, ebx
lea esi, cs:[esi]
nop
lea edx, [eax - 8]
mov dword [eax + 8], eax
add eax, 0x10
mov dword [eax - 0x10], edx
cmp eax, ecx
jne 0x40b350
jmp 0x40b22d
lea eax, [ebx + 0x20]
mov dword [ebx + 0x10], ebx
mov edi, eax
cmp eax, esi
jae 0x40b3a0
add ebx, 0x40
cmp esi, ebx
sbb edx, edx
and edx, 0xffffff82
add edx, 0x7f
nop
lea ecx, [eax - 0x10]
mov dword [eax + 0x10], eax
add eax, 0x20
mov dword [eax - 0x20], ecx
sub edx, 1
jne 0x40b380
cmp esi, ebx
sbb eax, eax
not eax
and eax, 0xfc0
lea eax, [edi + eax + 0x20]
sub eax, 0x10
jmp 0x40afea
mov ecx, 1
mov ebp, 0x10
jmp 0x40b2f5
lea edi, [ebx + 4]
mov ecx, ebx
xor eax, eax
mov dword [ebx], 0
mov dword [ebx + 0xffc], 0
and edi, 0xfffffffc
sub ecx, edi
add ecx, 0x1000
shr ecx, 2
rep stosd dword es:[edi], eax
jmp 0x40afb7
mov eax, 0xdffffff9
mov edi, 0xfffffff8
mov esi, 0x1fffffff
jmp 0x40abb9
mov dword [esp], 0x42d08c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub esp, 4
jmp 0x40ae02
mov eax, 0x1fffffff
jmp 0x40b121
mov eax, dword [esp + 0x44]
or eax, dword [0x42d530]
jne 0x40b015
mov eax, 1
call fcn.004088f0
mov dword [esp + 0x44], 1
jmp 0x40b033
call fcn.004025f0
test eax, eax
je 0x40b09e
mov eax, dword [0x42d780]
shr eax, 4
cmp eax, dword [0x42d7b4]
jb 0x40afed
mov eax, dword [0x42d794]
mov edx, dword [0x42d798]
mov edi, 0x3c
jmp 0x40b479
sub edi, 1
jb 0x40afed
add eax, dword [edi*4 + 0x42d560]
cmp eax, edx
jb 0x40b470
cmp esi, 0x1f
jg 0x40b48c
add esi, 1
cmp edi, esi
jl 0x40afed
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x20]
jmp 0x40b0cb
mov ebp, dword [esp + 0x48]
jmp 0x40aa2e
mov eax, ebx
jmp 0x40afea
lea eax, [ebx + 0x408]
mov dword [0x42d7c0], eax
jmp 0x40b067