Function at 0x445480
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x599e16
mov eax, dword fs:[0]
push eax
mov eax, 0x18ac
call fcn.0056c080
mov eax, dword [0x60f520]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1880], edx
mov edi, ecx
mov dword [ebp - 0x187c], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1870], eax
call fcn.0040bce0
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x4454e4
push 0x80004005
call fcn.0040c390
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1868], eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1864]
xorps xmm0, xmm0
mov dword [ebp - 0x188c], 0
movdqu xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x1890], 0
call fcn.00445320
mov ecx, dword [ebp - 0x1880]
xor esi, esi
mov dword [ebp - 0x1878], 0
mov dword [ebp - 0x1888], 0
mov dword [ebp - 0x1884], esi
mov eax, dword [ecx]
mov dword [ebp - 0x1874], esi
push dword [eax + 4]
call fcn.0041af00
mov ecx, dword [ebp - 0x1880]
mov eax, dword [ecx]
mov dword [eax + 4], eax
mov eax, dword [ecx]
mov dword [eax], eax
mov eax, dword [ecx]
mov dword [eax + 8], eax
mov eax, dword [ebp - 0x1870]
mov dword [ecx + 4], esi
mov dword [eax], esi
lea eax, [ebp - 0x1888]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call fcn.004453c0
push dword [ebp - 0x1888]
push esi
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x186c], eax
test eax, eax
jne 0x4455d0
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov edx, dword [ebp - 0x1868]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4455c9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
jmp 0x44586b
lea eax, [ebp - 0x1884]
push eax
push 0x5abd28
push 0
push edi
call dword [sym.imp.OLEACC.dll_AccessibleObjectFromWindow]
test eax, eax
jne 0x445819
mov edx, dword [ebp - 0x1884]
push ecx
lea ecx, [ebp - 0x1874]
call fcn.00441be0
mov esi, dword [ebp - 0x1874]
add esp, 4
test eax, eax
je 0x445819
test esi, esi
je 0x445819
push edi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x445819
mov eax, dword [esi]
lea ecx, [ebp - 0x1878]
push ecx
push esi
call dword [eax + 0x20]
lea eax, [ebp - 0x18a4]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 0x40
push 0x1000
push 0x10
push 0
push dword [ebp - 0x186c]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
test edi, edi
je 0x445819
lea eax, [ebp - 0x1890]
mov dword [ebp - 0x24], 1
push eax
push 0x10
lea eax, [ebp - 0x24]
push eax
push edi
push dword [ebp - 0x186c]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push edi
push 0
push 0x100e
push dword [ebp - 0x187c]
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x188c]
push eax
push 0x10
lea eax, [ebp - 0x24]
push eax
push edi
push dword [ebp - 0x186c]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0x8000
push 0
push edi
push dword [ebp - 0x186c]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov ecx, dword [ebp - 0x1870]
mov edi, 1
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
mov dword [ecx], eax
cmp dword [ebp - 0x1878], edi
jb 0x445819
mov ecx, 3
lea esp, [esp]
mov word [ebp - 0x18a4], cx
lea edx, [ebp - 0x18a4]
mov ecx, esi
mov dword [ebp - 0x189c], edi
call fcn.004418c0
test eax, 0x8000
jne 0x445807
test al, 1
jne 0x445807
lea eax, [ebp - 0x18a4]
mov edx, esi
push eax
lea ecx, [ebp - 0x1870]
call fcn.004419c0
add esp, 4
push eax
lea ecx, [ebp - 0x1868]
mov byte [ebp - 4], 1
call fcn.0040b7d0
lea ecx, [ebp - 0x1870]
mov byte [ebp - 4], 0
call fcn.0040c450
mov eax, dword [ebp - 0x1868]
lea edx, [ebp - 0x834]
sub edx, eax
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [edx + eax - 2], cx
test cx, cx
jne 0x445761
lea eax, [ebp - 0x18b4]
mov ecx, esi
push eax
lea edx, [ebp - 0x18a4]
call fcn.00441ad0
add esp, 4
movdqu xmm0, xmmword [eax]
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x1864]
push eax
movdqu xmmword [ebp - 0x34], xmm0
call dword [sym.imp.USER32.dll_CopyRect]
lea eax, [ebp - 0x1864]
push eax
push dword [ebp - 0x187c]
call dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [ebp - 0x185c]
push eax
push dword [ebp - 0x187c]
call dword [sym.imp.USER32.dll_ScreenToClient]
movdqu xmm0, xmmword [ebp - 0x1864]
mov ecx, dword [ebp - 0x1880]
lea eax, [ebp - 0x1864]
push 0x1830
push eax
lea eax, [ebp - 0x1868]
push eax
movdqu xmmword [ebp - 0x854], xmm0
movdqu xmmword [ebp - 0x844], xmm0
call fcn.00445890
push eax
call fcn.00559410
add esp, 0xc
inc edi
mov ecx, 3
cmp edi, dword [ebp - 0x1878]
jbe 0x4456f0
push dword [ebp - 0x186c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x44582f
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov ecx, dword [ebp - 0x1884]
test ecx, ecx
je 0x44583f
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov edx, dword [ebp - 0x1868]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x445866
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0055199a
mov esp, ebp
pop ebp
ret