Function at 0x4012d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
push edi
xor eax, eax
xor edi, edi
push esi
push ebx
sub esp, 0x13c
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x124], edx
mov dword [section..bss], eax
test ebx, ebx
mov dword [ebp - 0x128], edi
je 0x4014ce
movzx eax, byte [ebx]
test al, al
jne 0x401327
jmp 0x4014ce
mov edi, dword [sym.imp.msvcrt.dll__pctype]
mov esi, dword [edi]
movzx eax, word [esi + edx*2]
and eax, 8
test eax, eax
je 0x40134a
inc ebx
movzx eax, byte [ebx]
mov ecx, dword [sym.imp.msvcrt.dll___mb_cur_max]
movsx edx, al
cmp dword [ecx], 1
je 0x401310
mov dword [esp], edx
mov eax, 8
mov dword [esp + 4], eax
call sub.msvcrt.dll__isctype
test eax, eax
jne 0x401323
movzx ecx, byte [ebx]
cmp cl, 0x2d
je 0x401446
cmp cl, 0x22
sete dl
cmp cl, 0x27
sete al
xor edi, edi
or dl, al
je 0x40136f
inc ebx
movsx edi, cl
movzx ecx, byte [ebx]
xor esi, esi
test edi, edi
jne 0x401415
jmp 0x4013b6
mov ecx, dword [sym.imp.msvcrt.dll__pctype]
mov eax, dword [ecx]
movzx eax, word [eax + edx*2]
and eax, 8
test eax, eax
je 0x40139b
test edi, edi
je 0x401770
movzx edx, byte [ebx]
inc ebx
mov byte [esi + ebp - 0x118], dl
inc esi
cmp esi, 0xfe
jg 0x401770
movzx ecx, byte [ebx]
test cl, cl
je 0x401770
movsx edx, cl
mov ecx, dword [sym.imp.msvcrt.dll___mb_cur_max]
cmp dword [ecx], 1
je 0x401380
mov dword [esp], edx
mov eax, 8
mov dword [esp + 4], eax
call sub.msvcrt.dll__isctype
jmp 0x40138f
mov eax, dword [sym.imp.msvcrt.dll__pctype]
mov ecx, dword [eax]
movzx eax, word [ecx + edx*2]
and eax, 8
test eax, eax
je 0x4013fa
test edi, edi
je 0x401770
movzx ecx, byte [ebx]
inc ebx
mov byte [esi + ebp - 0x118], cl
inc esi
cmp esi, 0xfe
jg 0x401770
movzx ecx, byte [ebx]
test cl, cl
je 0x401770
movsx edx, cl
cmp edx, edi
je 0x401770
mov ecx, dword [sym.imp.msvcrt.dll___mb_cur_max]
cmp dword [ecx], 1
je 0x4013e0
mov dword [esp], edx
mov eax, 8
mov dword [esp + 4], eax
call sub.msvcrt.dll__isctype
jmp 0x4013ee
inc ebx
mov esi, ebx
movzx eax, byte [ebx]
test al, al
jne 0x40146f
jmp 0x4012fe
mov eax, dword [sym.imp.msvcrt.dll__pctype]
mov edi, dword [eax]
movzx eax, word [edi + edx*2]
and eax, 8
test eax, eax
jne 0x401492
inc ebx
movzx eax, byte [ebx]
test al, al
je 0x401496
mov ecx, dword [sym.imp.msvcrt.dll___mb_cur_max]
movsx edx, al
cmp dword [ecx], 1
je 0x401455
mov dword [esp], edx
mov ecx, 8
mov dword [esp + 4], ecx
call sub.msvcrt.dll__isctype
test eax, eax
je 0x401467
mov byte [ebx], 0
inc ebx
cmp byte [esi], 0
je 0x4012fe
mov dword [esp], esi
mov edx, str.nocd
mov dword [esp + 4], edx
call sub.msvcrt.dll__stricmp
test eax, eax
jne 0x4012fe
mov esi, 1
mov dword [section..bss], esi
movzx eax, byte [ebx]
test al, al
jne 0x401327
mov dword [esp], 0
mov esi, 0x100
mov ebx, 0x55a020
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
call sub.KERNEL32.dll_GetModuleFileNameA
sub esp, 0xc
test eax, eax
je 0x4016a1
mov dword [esp], 0x55a020
mov eax, 0x2f
mov dword [esp + 4], eax
call sub.msvcrt.dll_strrchr
test eax, eax
je 0x401703
mov byte [eax + 1], 0
mov dword [esp], 0
mov ecx, 0x40
mov edx, 0x1ba220
mov dword [esp + 0xc], ecx
mov edi, 0x1000
xor ebx, ebx
mov dword [esp + 8], edi
mov dword [esp + 4], edx
call sub.KERNEL32.dll_VirtualAlloc
sub esp, 0x10
test eax, eax
mov esi, eax
je 0x4016ad
mov dword [esp], esi
mov edx, 0x1ba220
xor eax, eax
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call sub.msvcrt.dll_memset
mov dword [esp], esi
call fcn.004178c0
cmp eax, 0xffffffff
je 0x40179e
lea edi, [esi + eax]
mov dword [ebp - 0x124], edi
mov ecx, 1
test ebx, ebx
mov dword [0x55a008], ecx
jne 0x40166e
lea edi, [ebp - 0x120]
jmp 0x4015b1
mov eax, dword [0x55a008]
test eax, eax
setne dl
test ebx, ebx
sete cl
test cl, dl
je 0x40166e
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [esp], eax
call fcn.00410b90
mov dword [esp + 0x14], ebx
xor ecx, ecx
mov edx, 0x3c
mov dword [esp + 0x10], ecx
mov eax, 0x20
mov ebx, 0x1e0
mov dword [esp + 4], ebx
mov ebx, 0xfffffffd
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp], 0x280
call fcn.0040ebc0
test eax, eax
je 0x40159a
call fcn.0040eb30
mov dword [0x55a004], eax
mov ebx, dword [ebp - 0x128]
mov edx, str.pce.exe
mov dword [ebp - 0x120], edx
cmp ebx, 1
sbb ecx, ecx
mov dword [ebp - 0x11c], ebx
lea ebx, [ecx + 2]
mov dword [esp + 4], eax
mov edx, dword [ebp + 8]
mov dword [esp], edx
call fcn.004047f0
test eax, eax
je 0x401792
mov dword [esp + 4], ebx
mov dword [esp + 8], edi
mov dword [esp], eax
call dword [ebp - 0x124]
mov ebx, eax
call fcn.00403de0
xor eax, eax
mov dword [0x55a008], eax
mov eax, dword [0x55a008]
test eax, eax
setne dl
test ebx, ebx
sete cl
test cl, dl
jne 0x4015b1
call fcn.0040e6c0
test esi, esi
je 0x401691
mov dword [esp], esi
mov ecx, 0x8000
xor edi, edi
mov dword [esp + 8], ecx
mov dword [esp + 4], edi
call sub.KERNEL32.dll_VirtualFree
sub esp, 0xc
test ebx, ebx
jne 0x4016b7
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov byte [0x55a020], 0
jmp 0x401518
mov ebx, 0xfffffffe
jmp 0x40157f
mov dword [esp + 8], ebx
lea esi, [ebp - 0x118]
mov eax, str.Initialization_error_:__i
mov dword [esp], esi
mov ebx, str.PCE.EXE
mov dword [esp + 4], eax
call sub.msvcrt.dll_sprintf
mov dword [esp + 8], ebx
mov edx, 0x30
mov dword [esp + 4], esi
mov dword [esp + 0xc], edx
mov dword [esp], 0
call sub.USER32.dll_MessageBoxA
sub esp, 0x10
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov dword [esp], 0x55a020
mov edx, 0x5c
mov dword [esp + 4], edx
call sub.msvcrt.dll_strrchr
test eax, eax
jne 0x401514
cmp byte [0x55a020], 0
je 0x401518
mov ebx, 0x55a020
mov edi, dword [ebx]
add ebx, 4
lea ecx, [edi - 0x1010101]
not edi
and ecx, edi
mov edx, ecx
and edx, 0x80808080
je 0x401732
mov eax, edx
lea esi, [ebx + 2]
shr eax, 0x10
and ecx, 0x8080
cmove edx, eax
mov cl, dl
cmove ebx, esi
add cl, dl
sbb ebx, 3
mov word [ebx], 0x5c
jmp 0x401518
test esi, esi
je 0x4012fe
xor ecx, ecx
lea edi, [ebp - 0x118]
mov byte [esi + ebp - 0x118], cl
mov dword [ebp - 0x128], edi
jmp 0x4012fe
call fcn.004017c0
mov ebx, eax
jmp 0x401650
mov ebx, 0xffffffff
jmp 0x40157f