Function at 0x401c35
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file on windows

Disassembly:
push dword [esp + 4]
pop dword [0x40c2fa]
push ebp
mov ebp, esp
push dword [0x40c014]
push eax
push ebx
push ecx
push edx
push esi
push edi
mov dword [0x40cc41], 0
mov eax, dword [0x40c2fa]
and eax, 0x10
je 0x401c6c
or dword [0x40c014], 0x400
or dword [0x40c014], 0x1000000
push str.shell32.dll
call sub.KERNEL32.dll_LoadLibraryA
and dword [0x40c014], 0xffffffef
mov dword [0x40c2ea], 2
lea eax, [0x40c326]
mov dword [0x40c2ee], eax
mov dword [0x40cc41], 0x58
test dword [0x40c014], 0x20
jne 0x401ccf
push dword [0x40cc41]
push str.Error__d
push 0x40c753
call sub.USER32.dll_wsprintfA
add esp, 0xc
jmp 0x401f6f
lea eax, [0x40d06b]
mov dword [0x40c00c], eax
mov dword [0x40d06b], 0x92
push str.KERNEL32.DLL
call sub.KERNEL32.dll_LoadLibraryA
cmp eax, 0
je 0x401d03
push str.FindClose
push eax
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x40cb80], eax
call fcn.004026f4
mov dword [0x40cc41], 0x50
jb 0x401f35
cmp eax, 0
mov dword [0x40cc41], 0x51
jne 0x401d9c
cmp dword [0x40cb96], 1
jne 0x401d70
mov dword [0x40cc41], 0x51
push 0x40c753
push 0x40c54b
call sub.KERNEL32.dll_lstrcpy
push 0x40c447
push 0x40c54b
push dword [0x40cc41]
push str.Error__d_r_n_s__specified_in__s__was_not_found.
push 0x40c753
call sub.USER32.dll_wsprintfA
add esp, 0x14
jmp 0x401f6f
mov dword [0x40cc41], 0x51
push 0x40c8bc
push dword [0x40cc41]
push str.Error__d_r_n_s_was_not_found.
push 0x40c753
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x401f6f
push 0x40c54b
push 0x40c018
call sub.KERNEL32.dll_lstrcpy
push 0x40
push 0x3000
mov eax, dword [0x40c9ec]
add eax, 0x10000
push eax
push 0
call sub.KERNEL32.dll_VirtualAlloc
cmp eax, 0
jne 0x401dd8
mov dword [0x40cc41], 0x52
jmp 0x401f35
mov dword [0x40cb0a], eax
and eax, 0xffff0000
mov dword [0x40cb0e], eax
push 0
push 0
push 3
push 0
push 3
push closesocket
push 0x40c54b
call sub.KERNEL32.dll_CreateFileA
mov dword [0x40cb12], eax
cmp eax, 0xffffffff
jne 0x401e19
mov dword [0x40cc41], 0x53
jmp 0x401f23
push 0
push 0x40cb6a
push dword [0x40c9ec]
push dword [0x40cb0e]
push dword [0x40cb12]
call sub.KERNEL32.dll_ReadFile
cmp eax, 0
jne 0x401e4b
mov dword [0x40cc41], 0x54
jmp 0x401f23
push dword [0x40cb12]
call sub.KERNEL32.dll_CloseHandle
test dword [0x40c014], 0x10000
je 0x401e76
call fcn.00402a60
mov dword [0x40cc41], 0
jmp 0x401f23
push str.KERNEL32.DLL
call sub.KERNEL32.dll_LoadLibraryA
cmp eax, 0
jne 0x401e94
mov dword [0x40cc41], 0x55
jmp 0x401f23
mov dword [0x40cb2f], eax
push str.GetProcAddress
push eax
call sub.KERNEL32.dll_GetProcAddress
cmp eax, 0
jne 0x401eb5
mov dword [0x40cc41], 0x56
jmp 0x401f23
mov dword [0x40c008], eax
push str.LoadLibraryA
push dword [0x40cb2f]
call sub.KERNEL32.dll_GetProcAddress
cmp eax, 0
jne 0x401edb
mov dword [0x40cc41], 0x57
jmp 0x401f23
mov dword [0x40c004], eax
mov eax, dword [0x40cb0e]
push section..data
add eax, dword [eax]
call eax
cmp eax, 0x2a3
jne 0x401efa
mov eax, 0
mov dword [0x40cc41], eax
cmp eax, 0
jne 0x401f1c
mov ebx, dword [0x40c30e]
cmp ebx, dword [0x40d133]
je 0x401f1c
cmp ebx, 0xffffffff
je 0x401f1c
call fcn.00402a91
mov byte [0x40cc45], 1
push 0x8000
push 0
push dword [0x40cb0a]
call sub.KERNEL32.dll_VirtualFree
cmp dword [0x40cc41], 0
je 0x401f8e
push 0x40c54b
push 0x40c11d
push dword [0x40cc41]
push str.Error__d_s_accessing__s
push 0x40c753
call sub.USER32.dll_wsprintfA
add esp, 0x14
push str._r_nMore_details_can_be_found_at_www.copyminder.com_kb
push 0x40c753
call sub.KERNEL32.dll_lstrcat
test dword [0x40c014], 0x10
jne 0x401f8e
push 0
push str.Error
push 0x40c753
push 0
call sub.USER32.dll_MessageBoxA
cmp byte [0x40cc45], 1
je 0x401f97
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
push dword [0x40c014]
pop dword [0x40cb72]
pop dword [0x40c014]
pop ebp
mov eax, dword [0x40cc41]
cmp eax, 0x28f
je fcn.00401c20
mov al, byte [0x40d116]
cmp al, 0
mov eax, dword [0x40cc41]
je 0x401feb
push eax
push ebx
push ecx
push edx
push esi
push edi
mov byte [0x40d116], 0
push 0x40d117
call sub.KERNEL32.dll_LeaveCriticalSection
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
ret 4