Function at 0x413b70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
push edi
lea ecx, [edx + edx*4]
push esi
lea esi, [eax + 0x378]
push ebx
shl ecx, 2
sub esp, 0x4c
mov edi, dword [esi*4 + 0x428a88]
mov ebx, dword [ecx + 0x41f020]
mov ebp, edi
mov dword [esp + 0x18], edi
lea edi, [ecx + 0x41f020]
mov ecx, ebp
shl ecx, 2
mov dword [esp + 0x20], ecx
add ecx, ebx
mov dword [esp + 0x1c], ecx
mov ecx, dword [ecx]
test ecx, ecx
je 0x413be0
mov eax, dword [ecx]
mov esi, dword [esp + 0x1c]
mov dword [esi], eax
mov eax, dword [esp + 0x18]
mov dword [ecx], 0
shl eax, 3
add dword [0x428aa4], eax
mov eax, ecx
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
test ebp, ebp
mov dword [esp + 0x2c], edx
jne 0x413e10
mov edi, dword [0x4287b8]
test edi, edi
je 0x414037
mov edi, dword [0x428a10]
lea edx, [edi + 7]
mov dword [esp + 0x18], edi
mov ebp, edx
not ebp
cmp eax, ebp
mov dword [esp + 0x14], ebp
jae 0x4142ad
add eax, edx
shr eax, 3
lea ecx, [eax*8]
mov edi, ecx
mov ebp, ecx
shr edi, 3
sub ebp, edi
mov edi, ebp
mov ebp, dword [edi*4 + 0x429868]
test ebp, ebp
jne 0x4140d2
mov edx, ecx
shr edx, 2
sub ecx, edx
mov edi, dword [ecx*4 + 0x429868]
test edi, edi
je 0x414120
lea esi, [esi]
lea edi, [edi]
add ecx, 1
mov edx, dword [ecx*4 + 0x429868]
test edx, edx
jne 0x413c60
lea ebp, [eax + 1]
and ebp, 0xfffffffe
cmp ebp, 0x100
mov eax, 0x100
mov edi, 0x200
cmova ebp, eax
mov eax, edi
xor edx, edx
div ebp
xor edx, edx
mov ebp, eax
mov eax, edi
div ebp
and eax, 0xfffffffe
lea edx, [eax*8]
sub edx, dword [esp + 0x18]
cmp edx, ecx
jb 0x413cbe
mov esi, esi
lea edi, [edi]
mov dword [ecx*4 + 0x429868], eax
add ecx, 1
cmp edx, ecx
jae 0x413cb0
mov eax, dword [esi*4 + 0x428a88]
mov dword [esp + 0x18], eax
shl eax, 2
add ebx, eax
mov dword [esp + 0x20], eax
mov ecx, dword [ebx]
mov dword [esp + 0x1c], ebx
test ecx, ecx
jne 0x413bb1
imul eax, dword [esp + 0x2c], 0x14
cmp dword [eax + 0x41f024], 0
jne 0x413ddf
mov ebx, dword [0x428ac0]
mov eax, dword [0x428ac8]
sub eax, ebx
cmp eax, 0x407
ja 0x413d99
mov ecx, dword [0x428a6c]
test ecx, ecx
je 0x41412d
mov dword [esp + 4], 0x11000
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea edx, [eax + 0xfff]
sub esp, 8
and edx, 0xfffff000
mov ebx, edx
test ebx, 0xfff
jne 0x4141dd
cmp dword [0x428b0c], 0x1ff
ja 0x4141f4
test ebx, ebx
je 0x4142c1
mov eax, dword [0x428b0c]
add dword [0x428aa0], 0x10000
cmp dword [0x428a70], 2
lea edx, [eax + 1]
mov dword [eax*4 + 0x43cc74], ebx
mov dword [0x428b0c], edx
je 0x414386
lea eax, [ebx + 0x10000]
mov dword [0x428ac8], eax
lea eax, [ebx + 0x408]
mov edx, ebx
mov dword [0x428ac0], eax
test edx, edx
je 0x413dfd
lea edi, [edx + 4]
mov ecx, edx
xor eax, eax
mov dword [edx], 0
mov dword [edx + 0x400], 0
and edi, 0xfffffffc
sub ecx, edi
add ecx, 0x404
shr ecx, 2
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x2c]
lea eax, [eax + eax*4]
mov dword [eax*4 + 0x41f024], edx
imul eax, dword [esp + 0x2c], 0x14
mov esi, dword [esp + 0x20]
add esi, dword [eax + 0x41f020]
cmp dword [esp + 0x18], 0
mov dword [esp + 0x24], esi
jne 0x414402
xor eax, eax
jmp 0x413bce
mov eax, dword [edi + 4]
test eax, eax
je 0x413cf2
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov dword [esp + 0x24], eax
mov eax, ebp
lea esi, [eax*8]
add eax, eax
mov dword [esp + 0x3c], 0
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], 0
lea eax, [eax + eax*4]
mov dword [esp + 0x28], eax
lea esi, [esi]
lea edi, [edi]
test ecx, ecx
jne 0x4140c3
mov eax, dword [0x4287d8]
test eax, eax
je 0x413e8a
cmp dword [0x41f00c], 0xf423f
je 0x413e8a
mov eax, dword [0x4287d0]
test eax, eax
je 0x414090
mov eax, dword [esp + 0x28]
mov edi, dword [esp + 0x20]
mov esi, dword [eax*4 + 0x41f024]
add edi, dword [eax*4 + 0x41f020]
test esi, esi
mov dword [esp + 0x14], edi
je 0x413f46
add esi, dword [esp + 0x20]
jmp 0x413f32
mov ebx, eax
mov edx, eax
shr ebx, 0x16
shr edx, 0xc
add ebx, 0x6e7c
and edx, 0x3ff
mov ecx, dword [ebx*4 + 0x428a84]
mov ecx, dword [ecx + edx*4]
mov edi, dword [ecx]
mov ecx, dword [ecx + 0x10]
mov dword [esi], edi
mov ebx, dword [ebx*4 + 0x428a84]
mov ebp, ecx
shr ebp, 3
mov edx, dword [ebx + edx*4]
movzx ebx, byte [edx + 0xc]
lea edi, [ebx + ebx*4]
mov ebx, dword [edi*4 + 0x41f020]
mov edi, dword [edi*4 + 0x41f030]
lea ebx, [ebx + ebp*4]
mov ebp, dword [0x428a14]
mov word [edx + 0xe], bp
mov ebp, dword [ebx]
mov dword [esp], edi
mov dword [esp + 4], ebp
call fcn.00419f70
mov dword [ebx], eax
mov eax, dword [esp + 0x14]
mov ebp, dword [eax]
test ebp, ebp
jne 0x413f38
mov eax, dword [esi]
test eax, eax
jne 0x413ec0
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
test ecx, ecx
jne 0x413e60
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 0x34]
xor ecx, ecx
mov edx, esi
call fcn.00418dc0
test eax, eax
mov ebx, eax
je 0x413fd5
cmp esi, 2
je 0x414330
mov eax, dword [esp + 0x28]
mov ebp, dword [esp + 0x20]
add ebp, dword [eax*4 + 0x41f020]
mov edi, dword [eax*4 + 0x41f030]
test edi, edi
mov esi, dword [ebp]
mov dword [esp + 0x14], esi
jne 0x414179
mov eax, dword [esp + 0x30]
cmp eax, 2
je 0x41425e
cmp eax, 4
je 0x414282
lea ecx, [eax*4]
mov edx, ebx
sub edx, ecx
lea eax, [ebx + ecx]
lea esi, [edx + 0x1000]
cmp eax, esi
ja 0x413fca
mov edx, ebx
nop
lea esi, [esi]
mov dword [eax], edx
add eax, ecx
add edx, ecx
cmp eax, esi
jbe 0x413fc0
mov esi, dword [esp + 0x14]
sub eax, ecx
mov dword [ebx], esi
mov dword [ebp], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
test ecx, ecx
jne 0x413e60
mov ecx, dword [0x4287d8]
test ecx, ecx
je 0x41400e
cmp dword [0x41f00c], 0xf423f
jne 0x41400e
mov edx, dword [esp + 0x38]
test edx, edx
jne 0x41400e
cmp dword [0x4287d0], 0
je 0x414432
mov edx, dword [esp + 0x3c]
mov eax, 1
call fcn.0041a110
test eax, eax
je 0x413dfd
mov eax, dword [esp + 0x24]
mov dword [esp + 0x3c], 1
mov ecx, dword [eax]
jmp 0x413e60
mov ebx, dword [0x4287b4]
test ebx, ebx
jne 0x414304
mov dword [esp + 0x14], eax
call fcn.00411200
mov eax, dword [esp + 0x14]
mov edx, dword [0x4287b4]
test edx, edx
jne 0x4142e7
mov edi, dword [esi*4 + 0x428a88]
test edi, edi
mov dword [esp + 0x18], edi
je 0x414422
mov eax, dword [esp + 0x2c]
lea eax, [eax + eax*4]
mov ebx, dword [eax*4 + 0x41f020]
mov eax, edi
jmp 0x413cc9
mov eax, 1
call fcn.0040fa30
mov eax, dword [esp + 0x28]
mov esi, dword [eax*4 + 0x41f024]
test esi, esi
je 0x413f38
mov edi, eax
mov eax, dword [esp + 0x20]
add eax, dword [edi*4 + 0x41f020]
mov dword [esp + 0x14], eax
jmp 0x413eac
mov dword [0x4287c4], 0
jmp 0x413bb1
mov ebp, dword [edi*4 + 0x42986c]
lea ecx, [edi + 1]
test ebp, ebp
je 0x414102
mov ebp, dword [esp + 0x14]
lea esi, [esi]
lea edi, [edi]
add ecx, 1
mov edi, dword [ecx*4 + 0x429868]
test edi, edi
jne 0x4140f0
mov dword [esp + 0x14], ebp
cmp dword [esp + 0x14], ecx
jbe 0x4143cf
add edx, ecx
mov edi, edx
shr edx, 6
shr edi, 3
add edx, edi
cmp eax, edx
jbe 0x41420b
add eax, 1
and eax, 0xfffffffe
mov ebp, eax
jmp 0x413c74
cmp dword [0x421828], 1
mov edx, dword [0x428a64]
mov dword [esp], 0
sbb eax, eax
and eax, 0xffffffc4
add eax, 0x40
mov dword [esp + 0xc], eax
mov eax, dword [0x428a68]
or ah, 0x30
mov dword [esp + 8], eax
xor eax, eax
test edx, edx
sete al
add eax, 0x10000
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub esp, 0x10
mov ebx, eax
jmp 0x413d3e
mov eax, dword [esp + 0x30]
cmp eax, 2
je 0x414218
cmp eax, 4
jne 0x41439f
lea eax, [ebx + 0x10]
mov dword [ebx], esi
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
add ebx, 0x1000
cmp eax, ebx
jae 0x4141d5
lea edx, [eax - 0x10]
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
add eax, 0x10
mov dword [eax - 0x10], edx
cmp eax, ebx
jb 0x4141b3
sub eax, 0x10
jmp 0x413fd2
mov dword [esp], 0x423a24
call fcn.00410030
call dword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x413d4a
mov dword [esp], 0x423a3c
call fcn.00410030
call dword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x413d5a
add edx, 1
and edx, 0xfffffffe
mov ebp, edx
jmp 0x413c74
lea eax, [ebx + 0x10]
mov dword [ebx], esi
mov dword [ebx + 4], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 8], ebx
add ebx, 0x1000
cmp eax, ebx
jae 0x414256
lea edx, [eax - 8]
mov dword [eax + 4], 0
mov dword [eax + 0xc], 0
mov dword [eax + 8], eax
add eax, 0x10
mov dword [eax - 0x10], edx
cmp eax, ebx
jb 0x414238
sub eax, 8
jmp 0x413fd2
lea eax, [ebx + 0x10]
mov dword [ebx], esi
mov dword [ebx + 8], ebx
add ebx, 0x1000
cmp eax, ebx
jae 0x414256
lea edx, [eax - 8]
mov dword [eax + 8], eax
add eax, 0x10
mov dword [eax - 0x10], edx
cmp eax, ebx
jb 0x414270
jmp 0x414256
lea eax, [ebx + 0x20]
mov dword [ebx], esi
mov dword [ebx + 0x10], ebx
add ebx, 0x1000
cmp eax, ebx
jae 0x4141d5
lea edx, [eax - 0x10]
mov dword [eax + 0x10], eax
add eax, 0x20
mov dword [eax - 0x20], edx
cmp eax, ebx
jb 0x414298
jmp 0x4141d5
mov edi, 0xdffffff9
mov ecx, 0xfffffff8
mov eax, 0x1fffffff
jmp 0x413c2e
mov dword [esp + 4], 0x408
mov dword [esp], 0x423a6c
call dword [0x42182c]
mov eax, 0x408
call fcn.00413a00
mov edx, eax
jmp 0x413da6
mov dword [esp + 0x14], eax
mov dword [esp], 0x42879c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub esp, 4
mov eax, dword [esp + 0x14]
jmp 0x414060
mov dword [esp + 0x14], eax
mov dword [esp], 0x42879c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x4287b8]
sub esp, 4
mov eax, dword [esp + 0x14]
test ecx, ecx
jne 0x414052
jmp 0x414045
mov eax, ebx
shr eax, 0x16
mov edx, dword [eax*4 + 0x444474]
mov eax, ebx
shr eax, 0xc
and eax, 0x3ff
mov esi, dword [edx + eax*4]
xor edx, edx
mov eax, 0x1000
mov ecx, dword [esi + 0x10]
div ecx
cmp ecx, 0x800
mov edi, eax
jbe 0x4143de
mov ecx, 1
mov eax, 0x10
xor edx, edx
mov dword [esi + edx*4 + 0x20], 0xffffffff
add edx, 1
cmp edx, eax
jb 0x41436b
mov dword [esi + edx*4 + 0x20], ecx
mov dword [esi + 0x1c], edi
jmp 0x413f66
mov dword [esp + 4], 0x10000
mov dword [esp], 0x423a53
call fcn.004101f0
jmp 0x413d8e
lea edi, [ebx + 4]
mov ecx, ebx
xor eax, eax
mov dword [ebx], 0
mov dword [ebx + 0xffc], 0
and edi, 0xfffffffc
sub ecx, edi
add ecx, 0x1000
shr ecx, 2
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x30]
jmp 0x413fa1
mov edx, 0x800
mov eax, 0x100
jmp 0x413c9f
mov eax, ecx
imul eax, edi
mov ecx, eax
shr eax, 8
shr ecx, 3
test eax, eax
je 0x41440d
mov edx, 1
shl edx, cl
lea ecx, [edx + edx - 2]
or ecx, 1
jmp 0x414369
mov ecx, dword [esi]
mov eax, dword [esp + 0x18]
jmp 0x413e27
mov eax, 1
xor edx, edx
shl eax, cl
lea ecx, [eax + eax - 2]
or ecx, 1
jmp 0x41437a
imul edx, dword [esp + 0x2c], 0x14
mov ebx, dword [edx + 0x41f020]
jmp 0x413bfa
mov eax, 1
call fcn.0040fa30
mov eax, dword [esp + 0x24]
mov dword [esp + 0x38], 1
mov ecx, dword [eax]
jmp 0x413e60