Function at 0x40a030
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov dword [ebp - 0xc], edi
test edi, edi
je 0x40a405
cmp ebx, 0x40
jb 0x40a405
mov eax, 0x5a4d
cmp ax, word [edi]
jne 0x40a405
mov ecx, dword [edi + 0x3c]
lea eax, [ecx + 0xf8]
cmp ebx, eax
jb 0x40a405
cmp dword [ecx + edi], 0x4550
lea eax, [ecx + edi]
mov dword [ebp - 4], eax
jne 0x40a405
mov edx, 0x14c
cmp dx, word [eax + 4]
jne 0x40a405
test byte [eax + 0x16], 2
je 0x40a405
movzx eax, word [eax + 0x14]
mov edx, 0xe0
cmp ax, dx
jb 0x40a405
add eax, 0xffffff20
xor edx, edx
movzx eax, ax
mov dword [ebp - 0x14], eax
lea esi, [eax + ecx]
mov eax, dword [ebp - 4]
add esi, edi
movzx eax, word [eax + 6]
mov edi, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], edi
xor edi, edi
cmp di, ax
mov edi, dword [ebp - 0xc]
jae 0x40a106
nop dword [eax]
movzx eax, dx
lea ecx, [eax + eax*4]
mov eax, dword [esi + ecx*8 + 0x10c]
add eax, dword [esi + ecx*8 + 0x108]
cmp eax, ebx
ja 0x40a405
inc edx
cmp dx, word [ebp - 0x10]
jb 0x40a0e0
mov ecx, dword [edi + 0x3c]
mov eax, dword [ebp - 0x14]
lea edx, [edi + 0xf8]
mov esi, dword [ebp - 4]
add eax, ecx
add edx, eax
mov eax, dword [ebp - 0x18]
movzx ecx, ax
xor eax, eax
mov dword [ebp - 8], edx
mov ebx, dword [esi + 0x50]
mov dword [ebp - 0x10], ebx
cmp ax, cx
jae 0x40a16a
lea edi, [edx + 8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [edi + 8]
mov esi, ebx
cmp ecx, dword [edi]
mov edx, dword [ebp - 4]
cmovbe ecx, dword [edi]
lea edi, [edi + 0x28]
add ecx, dword [edi - 0x24]
mov ebx, dword [edx + 0x38]
xor edx, edx
dec ebx
add ebx, ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
div dword [ecx + 0x38]
sub ebx, edx
cmp esi, ebx
cmova ebx, esi
sub dword [ebp - 0x10], 1
jne 0x40a132
mov edi, dword [ebp - 0xc]
mov esi, ecx
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x40a405
push 0x40
push 0x3000
lea eax, [ebx + 0x14]
push eax
push dword [esi + 0x34]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x40a1a8
push 0x40
push 0x3000
lea eax, [ebx + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x40a405
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
movzx eax, word [eax + 6]
lea eax, [eax + eax*4]
lea ecx, [ecx + eax*8]
mov eax, dword [edi + 0x3c]
add ecx, 0xf8
add eax, ecx
push eax
push edi
push esi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 4]
xor ecx, ecx
add esp, 0xc
xor edi, edi
cmp cx, word [eax + 6]
jae 0x40a21e
mov ebx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
movzx eax, di
lea eax, [eax + eax*4]
mov edx, dword [ecx + eax*8 + 0x10]
test edx, edx
je 0x40a211
mov ecx, dword [ecx + eax*8 + 0xc]
test ecx, ecx
je 0x40a20e
push edx
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x14]
add eax, ebx
push eax
lea eax, [ecx + esi]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
inc edi
cmp di, word [eax + 6]
jb 0x40a1e1
mov ebx, dword [ebp - 0x10]
lea eax, [esi + ebx]
mov dword [eax + 0x10], 0
push 8
mov dword [ebp - 0x20], eax
mov dword [eax + 0xc], 0
mov dword [eax + 8], 0
mov dword [eax + 4], 0
mov dword [eax], 0
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
mov dword [ebp - 0xc], ebx
test ebx, ebx
je 0x40a3f7
mov ecx, dword [esi + 0x3c]
mov eax, esi
mov dword [ebx + 4], esi
sub eax, dword [ecx + esi + 0x34]
mov dword [ebp - 0x14], eax
je 0x40a326
cmp dword [ecx + esi + 0xa4], 0
je 0x40a326
mov edi, dword [ecx + esi + 0xa0]
mov dword [ebp - 0x10], edi
lea ecx, [edi + esi]
mov ebx, ecx
cmp dword [ebx], 0
je 0x40a323
mov dword [ebp - 0x18], 0xa
mov dword [ebp - 8], 3
nop word [eax + eax]
mov eax, dword [ebx + 4]
mov edx, 0
sub eax, 8
shr eax, 1
mov dword [ebp - 0x1c], eax
je 0x40a313
lea edi, [ecx + 8]
movzx eax, word [edi]
mov cx, ax
shr cx, 0xc
movzx ecx, cx
cmp word [ebp - 0x18], cx
jne 0x40a2e7
mov ecx, dword [ebp - 0x14]
and eax, 0xfff
add eax, dword [ebx]
add dword [eax + esi], ecx
jmp 0x40a307
cmp word [ebp - 8], cx
jne 0x40a2fc
mov ecx, dword [ebp - 0x14]
and eax, 0xfff
add eax, dword [ebx]
add dword [eax + esi], ecx
jmp 0x40a307
xor eax, eax
cmp ax, cx
jne 0x40a3eb
inc edx
add edi, 2
cmp edx, dword [ebp - 0x1c]
jb 0x40a2c5
mov edi, dword [ebp - 0x10]
add edi, dword [ebx + 4]
mov dword [ebp - 0x10], edi
lea ecx, [edi + esi]
mov ebx, ecx
cmp dword [ebx], 0
jne 0x40a2b0
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x20]
sub esp, 8
mov edx, esi
mov ecx, edi
call fcn.00409dd0
add esp, 8
test eax, eax
je 0x40a3eb
mov edx, 0x442f30
mov ecx, 1
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x40a345
mov eax, dword [0x442f38]
inc dword [0x442f34]
mov dword [ebx], eax
xor eax, eax
mov dword [0x442f38], ebx
xchg dword [edx], eax
mov ecx, dword [ebp - 4]
mov edx, 0x2000
mov ax, word [ecx + 0x16]
and ax, dx
xor edx, edx
cmp dx, ax
je 0x40a410
mov eax, dword [ecx + 0x28]
test eax, eax
je 0x40a410
push edx
push 1
push esi
add eax, esi
call eax
test eax, eax
jne 0x40a410
call fcn.00409f20
mov eax, dword [0x442f38]
xor edx, edx
test eax, eax
je 0x40a3d4
mov ecx, dword [eax]
cmp eax, ebx
je 0x40a3c0
mov edx, eax
mov eax, ecx
test eax, eax
jne 0x40a3b0
jmp 0x40a3d4
test edx, edx
jne 0x40a3cc
mov dword [0x442f38], ecx
jmp 0x40a3ce
mov dword [edx], ecx
dec dword [0x442f34]
xor eax, eax
mov ecx, 0x442f30
xchg dword [ecx], eax
push 0
mov edx, esi
mov ecx, edi
call fcn.00409f40
add esp, 4
push dword [ebp - 0xc]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc