Function at 0x412770
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1868
call fcn.00421f50
mov eax, dword [0x436680]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x40
push 0x3000
xor ebx, ebx
push 0x400
push ebx
mov edi, edx
push eax
mov dword [ebp - 0x185c], eax
mov dword [ebp - 0x1858], ecx
mov dword [ebp - 0x1844], edi
mov dword [ebp - 0x1864], ebx
mov dword [ebp - 0x1860], ebx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
lea esi, [ebp - 0x1834]
mov dword [ebp - 0x1850], eax
call fcn.004125c0
lea edx, [ebp - 0x1860]
push edx
lea eax, [ebp - 0x1864]
push eax
call fcn.004124c0
mov ecx, dword [ebp - 0x1864]
mov eax, dword [ebp - 0x1860]
add esp, 8
push ecx
call fcn.004126b0
push 0x3ff
lea edx, [ebp - 0x81b]
push ebx
push edx
mov byte [ebp - 0x81c], bl
call fcn.00421c00
push edi
lea eax, [ebp - 0x81c]
push str.The_DLL___s__was_not_able_to_be_loaded_successfully.
push eax
mov edx, 0x3ff
call fcn.004131e0
push 0x3ff
lea ecx, [ebp - 0x41b]
push ebx
push ecx
mov byte [ebp - 0x41c], bl
call fcn.00421c00
push str.Initialize
lea edx, [ebp - 0x41c]
push str.The_function___s__was_not_able_to_be_loaded_from_the_DLL_successfully.
push edx
mov edx, 0x3ff
call fcn.004131e0
mov edi, dword [ebp - 0x828]
mov ebx, dword [ebp - 0x820]
mov dword [ebp - 0x184c], edi
add edi, 0xb
add esp, 0x30
cmp edi, ebx
jb 0x412893
push 0x10
push str.AddString_workspace_buffer_overflow.
push str.Error
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.00419097
mov ecx, dword [str.user32.dll]
mov eax, dword [ebp - 0x828]
mov esi, dword [ebp - 0x830]
mov dword [esi + eax], ecx
mov edx, dword [0x431a14]
mov dword [esi + eax + 4], edx
mov cx, word [0x431a18]
mov word [esi + eax + 8], cx
mov dl, byte [0x431a1a]
mov byte [esi + eax + 0xa], dl
lea eax, [edi + 0xc]
mov dword [ebp - 0x1840], edi
mov dword [ebp - 0x183c], eax
cmp eax, ebx
jb 0x4128fa
push 0x10
push str.AddString_workspace_buffer_overflow.
push str.Error
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.00419097
mov eax, dword [ebp - 0x183c]
mov ecx, dword [0x431a1c]
mov dword [esi + edi], ecx
mov edx, dword [0x431a20]
mov dword [esi + edi + 4], edx
mov ecx, dword [0x431a24]
mov dword [esi + edi + 8], ecx
mov ecx, eax
mov eax, dword [ebp - 0x1844]
mov dword [ebp - 0x828], ecx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x412928
sub eax, edi
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
inc eax
lea edx, [ecx + eax]
mov dword [ebp - 0x183c], eax
mov dword [ebp - 0x1838], edx
cmp edx, ebx
jb 0x41296c
push 0x10
push str.AddString_workspace_buffer_overflow.
push str.Error
push 0
call edi
call fcn.00419097
mov eax, dword [ebp - 0x183c]
mov ecx, dword [ebp - 0x828]
mov edx, dword [ebp - 0x1844]
push eax
push edx
lea eax, [esi + ecx]
push eax
call fcn.0041aad0
mov eax, dword [ebp - 0x1838]
lea ecx, [eax + 0xc]
add esp, 0xc
cmp ecx, ebx
jb 0x4129a8
push 0x10
push str.AddString_workspace_buffer_overflow.
push str.Error
push 0
call edi
call fcn.00419097
mov eax, dword [ebp - 0x1838]
mov ecx, dword [str.Fatal_Error]
mov dword [esi + eax], ecx
mov edx, dword [0x43164c]
mov dword [esi + eax + 4], edx
mov ecx, dword [0x431650]
mov dword [esi + eax + 8], ecx
lea ecx, [eax + 0x17]
cmp ecx, ebx
jb 0x4129e7
push 0x10
push str.AddString_workspace_buffer_overflow.
push str.Error
push 0
call edi
call fcn.00419097
mov eax, dword [ebp - 0x1838]
mov edx, dword [str.Initialize]
mov dword [esi + eax + 0xc], edx
mov ecx, dword [0x43167c]
mov dword [esi + eax + 0x10], ecx
mov dx, word [0x431680]
mov word [esi + eax + 0x14], dx
mov cl, byte [0x431682]
mov byte [esi + eax + 0x16], cl
lea ecx, [ebp - 0x81c]
lea edx, [ecx + 1]
mov dword [ebp - 0x183c], edx
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x412a20
sub ecx, dword [ebp - 0x183c]
inc ecx
lea edx, [eax + ecx + 0x17]
mov dword [ebp - 0x183c], ecx
mov dword [ebp - 0x1844], edx
cmp edx, ebx
jb 0x412a63
push 0x10
push str.AddString_workspace_buffer_overflow.
push str.Error
push 0
call edi
call fcn.00419097
mov ecx, dword [ebp - 0x183c]
mov eax, dword [ebp - 0x1838]
push ecx
lea ecx, [ebp - 0x81c]
push ecx
lea edx, [esi + eax + 0x17]
push edx
call fcn.0041aad0
lea eax, [ebp - 0x41c]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412a81
mov ecx, dword [ebp - 0x1844]
sub eax, edx
inc eax
add ecx, eax
mov dword [ebp - 0x183c], eax
mov dword [ebp - 0x1848], ecx
cmp ecx, ebx
jb 0x412abe
push 0x10
push str.AddString_workspace_buffer_overflow.
push str.Error
push 0
call edi
call fcn.00419097
mov eax, dword [ebp - 0x183c]
push eax
mov eax, dword [ebp - 0x1844]
lea edx, [ebp - 0x41c]
push edx
lea ecx, [esi + eax]
push ecx
call fcn.0041aad0
add esp, 0xc
cmp dword [ebp - 0x834], 0
ja 0x412af6
push 0x10
push str.Error
push str.SetPlaceHolder_called_with_an_illegal_index.
push 0
call edi
call fcn.00419097
mov edx, dword [ebp - 0x1834]
mov eax, dword [ebp - 0x184c]
add edx, esi
cmp dword [ebp - 0x834], 2
mov dword [edx + ebx], eax
ja 0x412b25
push 0x10
push str.Error
push str.SetPlaceHolder_called_with_an_illegal_index.
push 0
call edi
call fcn.00419097
mov ecx, dword [ebp - 0x182c]
mov edx, dword [ebp - 0x1840]
add ecx, esi
cmp dword [ebp - 0x834], 5
mov dword [ecx + ebx], edx
ja 0x412b54
push 0x10
push str.Error
push str.SetPlaceHolder_called_with_an_illegal_index.
push 0
call edi
call fcn.00419097
mov eax, dword [ebp - 0x1820]
mov ecx, dword [ebp - 0x828]
add eax, esi
cmp dword [ebp - 0x834], 7
mov dword [eax + ebx], ecx
ja 0x412b83
push 0x10
push str.Error
push str.SetPlaceHolder_called_with_an_illegal_index.
push 0
call edi
call fcn.00419097
mov edx, dword [ebp - 0x1818]
mov eax, dword [ebp - 0x1838]
add edx, esi
cmp dword [ebp - 0x834], 8
mov dword [edx + ebx], eax
ja 0x412bb2
push 0x10
push str.Error
push str.SetPlaceHolder_called_with_an_illegal_index.
push 0
call edi
call fcn.00419097
mov ecx, dword [ebp - 0x1814]
mov eax, dword [ebp - 0x1838]
add ecx, esi
add eax, 0x17
cmp dword [ebp - 0x834], 0xc
mov dword [ecx + ebx], eax
ja 0x412be4
push 0x10
push str.Error
push str.SetPlaceHolder_called_with_an_illegal_index.
push 0
call edi
call fcn.00419097
mov edx, dword [ebp - 0x1804]
mov eax, dword [ebp - 0x1838]
add edx, esi
add eax, 0xc
cmp dword [ebp - 0x834], 0xe
mov dword [edx + ebx], eax
ja 0x412c16
push 0x10
push str.Error
push str.SetPlaceHolder_called_with_an_illegal_index.
push 0
call edi
call fcn.00419097
mov eax, dword [ebp - 0x17fc]
mov ecx, dword [ebp - 0x1838]
add eax, esi
cmp dword [ebp - 0x834], 0xf
mov dword [eax + ebx], ecx
ja 0x412c45
push 0x10
push str.Error
push str.SetPlaceHolder_called_with_an_illegal_index.
push 0
call edi
call fcn.00419097
mov edx, dword [ebp - 0x17f8]
mov eax, dword [ebp - 0x1844]
push 0x431a28
add edx, esi
push str.kernel32.dll
mov dword [edx + ebx], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x1848]
mov dword [ebp - 0x1840], eax
lea eax, [ecx + 4]
mov dword [ebp - 0x184c], ecx
mov dword [ebp - 0x1838], eax
cmp eax, ebx
jb 0x412cad
push 0x10
push str.AddDword_workspace_buffer_overflow.
push str.Error
push 0
call edi
call fcn.00419097
mov eax, dword [ebp - 0x1838]
mov ecx, dword [ebp - 0x1848]
mov edx, dword [ebp - 0x1840]
push 0x431a48
push str.kernel32.dll
mov dword [esi + ecx], edx
mov dword [ebp - 0x828], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1840], eax
mov eax, dword [ebp - 0x828]
lea ecx, [eax + 4]
mov dword [ebp - 0x1848], eax
mov dword [ebp - 0x1838], ecx
cmp ecx, ebx
jb 0x412d13
push 0x10
push str.AddDword_workspace_buffer_overflow.
push str.Error
push 0
call edi
call fcn.00419097
mov ecx, dword [ebp - 0x1838]
mov eax, dword [ebp - 0x828]
mov edx, dword [ebp - 0x1840]
push 0x431a58
push str.kernel32.dll
mov dword [esi + eax], edx
mov dword [ebp - 0x828], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x828]
mov dword [ebp - 0x1840], eax
lea eax, [ecx + 4]
mov dword [ebp - 0x183c], ecx
mov dword [ebp - 0x1838], eax
cmp eax, ebx
jb 0x412d79
push 0x10
push str.AddDword_workspace_buffer_overflow.
push str.Error
push 0
call edi
call fcn.00419097
mov eax, dword [ebp - 0x1838]
mov ecx, dword [ebp - 0x828]
mov edx, dword [ebp - 0x1840]
mov dword [esi + ecx], edx
lea ecx, [eax + 4]
mov dword [ebp - 0x828], eax
mov dword [ebp - 0x1844], eax
mov dword [ebp - 0x1838], ecx
cmp ecx, ebx
jb 0x412dbc
push 0x10
push str.AddDword_workspace_buffer_overflow.
push str.Error
push 0
call edi
call fcn.00419097
mov ecx, dword [ebp - 0x1838]
mov eax, dword [ebp - 0x828]
xor edx, edx
mov dword [esi + eax], edx
mov eax, ecx
lea ecx, [eax + 4]
mov dword [ebp - 0x828], eax
mov dword [ebp - 0x1840], eax
mov dword [ebp - 0x1838], ecx
cmp ecx, ebx
jb 0x412dfc
push 0x10
push str.AddDword_workspace_buffer_overflow.
push str.Error
push edx
call edi
call fcn.00419097
mov eax, dword [ebp - 0x828]
mov ecx, dword [ebp - 0x1838]
xor edx, edx
mov dword [esi + eax], edx
mov eax, ecx
lea ecx, [eax + 4]
mov dword [ebp - 0x828], eax
mov dword [ebp - 0x1854], eax
mov dword [ebp - 0x1838], ecx
cmp ecx, ebx
jb 0x412e3c
push 0x10
push str.AddDword_workspace_buffer_overflow.
push str.Error
push edx
call edi
call fcn.00419097
mov eax, dword [ebp - 0x828]
mov ecx, dword [ebp - 0x1838]
mov edx, dword [ebp - 0x1858]
mov dword [esi + eax], edx
mov eax, ecx
mov dword [ebp - 0x828], eax
add eax, 4
mov dword [ebp - 0x1838], eax
cmp eax, ebx
jb 0x412e6f
push 0x10
push str.AddDword_workspace_buffer_overflow.
push str.Error
push 0
call edi
call fcn.00419097
cmp dword [ebp - 0x834], 1
mov eax, dword [ebp - 0x1850]
mov ecx, dword [ebp - 0x828]
mov dword [esi + ecx], eax
ja 0x412e9c
push 0x10
push str.Error
push str.SetPlaceHolder_called_with_an_illegal_index.
push 0
call edi
call fcn.00419097
mov edx, dword [ebp - 0x1830]
mov eax, dword [ebp - 0x184c]
add edx, esi
cmp dword [ebp - 0x834], 3
mov dword [edx + ebx], eax
ja 0x412ecb
push 0x10
push str.Error
push str.SetPlaceHolder_called_with_an_illegal_index.
push 0
call edi
call fcn.00419097
mov ecx, dword [ebp - 0x1828]
mov edx, dword [ebp - 0x1848]
add ecx, esi
cmp dword [ebp - 0x834], 4
mov dword [ecx + ebx], edx
ja 0x412efa
push 0x10
push str.Error
push str.SetPlaceHolder_called_with_an_illegal_index.
push 0
call edi
call fcn.00419097
mov eax, dword [ebp - 0x1824]
mov ecx, dword [ebp - 0x1844]
add eax, esi
cmp dword [ebp - 0x834], 6
mov dword [eax + ebx], ecx
ja 0x412f29
push 0x10
push str.Error
push str.SetPlaceHolder_called_with_an_illegal_index.
push 0
call edi
call fcn.00419097
mov edx, dword [ebp - 0x181c]
mov eax, dword [ebp - 0x184c]
add edx, esi
cmp dword [ebp - 0x834], 9
mov dword [edx + ebx], eax
ja 0x412f58
push 0x10
push str.Error
push str.SetPlaceHolder_called_with_an_illegal_index.
push 0
call edi
call fcn.00419097
mov ecx, dword [ebp - 0x1810]
mov edx, dword [ebp - 0x1844]
add ecx, esi
cmp dword [ebp - 0x834], 0xa
mov dword [ecx + ebx], edx
ja 0x412f87
push 0x10
push str.Error
push str.SetPlaceHolder_called_with_an_illegal_index.
push 0
call edi
call fcn.00419097
mov eax, dword [ebp - 0x180c]
mov ecx, dword [ebp - 0x183c]
add eax, esi
cmp dword [ebp - 0x834], 0xb
mov dword [eax + ebx], ecx
ja 0x412fb6
push 0x10
push str.Error
push str.SetPlaceHolder_called_with_an_illegal_index.
push 0
call edi
call fcn.00419097
mov edx, dword [ebp - 0x1808]
mov eax, dword [ebp - 0x1840]
add edx, esi
cmp dword [ebp - 0x834], 0xd
mov dword [edx + ebx], eax
ja 0x412fe5
push 0x10
push str.Error
push str.SetPlaceHolder_called_with_an_illegal_index.
push 0
call edi
call fcn.00419097
mov ecx, dword [ebp - 0x1800]
mov edx, dword [ebp - 0x1848]
add ecx, esi
cmp dword [ebp - 0x834], 0x10
mov dword [ecx + ebx], edx
ja 0x413014
push 0x10
push str.Error
push str.SetPlaceHolder_called_with_an_illegal_index.
push 0
call edi
call fcn.00419097
mov eax, dword [ebp - 0x17f4]
mov ecx, dword [ebp - 0x1844]
add eax, esi
cmp dword [ebp - 0x834], 0x11
mov dword [eax + ebx], ecx
ja 0x413043
push 0x10
push str.Error
push str.SetPlaceHolder_called_with_an_illegal_index.
push 0
call edi
call fcn.00419097
mov edx, dword [ebp - 0x17f0]
mov eax, dword [ebp - 0x183c]
add edx, esi
cmp dword [ebp - 0x834], 0x13
mov dword [edx + ebx], eax
ja 0x413072
push 0x10
push str.Error
push str.SetPlaceHolder_called_with_an_illegal_index.
push 0
call edi
call fcn.00419097
mov ecx, dword [ebp - 0x17e8]
mov edx, dword [ebp - 0x1854]
add ecx, esi
cmp dword [ebp - 0x834], 0x14
mov dword [ecx + ebx], edx
ja 0x4130a1
push 0x10
push str.Error
push str.SetPlaceHolder_called_with_an_illegal_index.
push 0
call edi
call fcn.00419097
mov eax, dword [ebp - 0x17e4]
mov ecx, dword [ebp - 0x828]
add eax, esi
mov dword [eax + ebx], ecx
mov ecx, dword [ebp - 0x1858]
xor eax, eax
lea edx, [ebp - 0x1868]
push edx
mov edx, dword [ebp - 0x185c]
push 6
mov dword [ebp - 0xf], eax
mov byte [ebp - 0xb], al
mov dword [ebp - 0x1868], eax
lea eax, [ebp - 0x10]
push eax
push ecx
push edx
mov byte [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x1838]
lea ecx, [eax + 6]
mov dword [ebp - 0x1840], eax
mov dword [ebp - 0x1854], ecx
cmp ecx, ebx
jb 0x41311f
push 0x10
push str.WriteArray_workspace_buffer_overflow.
push str.Error
push 0
call edi
call fcn.00419097
mov eax, dword [ebp - 0x1838]
mov ecx, dword [ebp - 0x1854]
cmp dword [ebp - 0x834], 0x12
mov edx, dword [ebp - 0x10]
mov dword [esi + eax], edx
mov dx, word [ebp - 0xc]
mov word [esi + eax + 4], dx
mov dword [ebp - 0x828], ecx
ja 0x413152
push 0x10
push str.Error
push str.SetPlaceHolder_called_with_an_illegal_index.
push 0
call edi
call fcn.00419097
mov eax, dword [ebp - 0x17ec]
mov ecx, dword [ebp - 0x1840]
mov edi, dword [ebp - 0x1850]
add eax, esi
mov dword [eax + ebx], ecx
add ebx, dword [ebp - 0x824]
lea esi, [ebp - 0x1834]
call fcn.00412650
mov esi, ebx
mov ebx, dword [ebp - 0x185c]
push eax
call fcn.00412440
mov edi, dword [ebp - 0x1858]
mov eax, dword [ebp - 0x1850]
sub eax, edi
add eax, 0x1fb
mov dword [ebp - 0x17], eax
lea eax, [ebp - 0x18]
push eax
mov esi, 6
mov byte [ebp - 0x18], pe_nt_image_headers32
mov byte [ebp - 0x13], 0x90
call fcn.00412440
mov ecx, dword [ebp - 0x830]
push ecx
call fcn.00418f65
mov edx, dword [ebp - 0x82c]
push edx
call fcn.00418f65
mov ecx, dword [ebp - 8]
add esp, 0x10
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418429
mov esp, ebp
pop ebp
ret