Function at 0x43bac0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x60
mov eax, dword [0x4fc060]
test eax, eax
jne 0x43beff
lea eax, [ebp - 0x3e]
mov ecx, eax
call fcn.00490618
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 9]
xor eax, 1
test al, al
je 0x43bc4d
mov eax, dword [ebp - 0x14]
lea edx, [eax + 4]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
add ecx, 0xa
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x24]
cmp eax, 0x12
ja 0x43bc4c
jmp 0x43bb34
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
lea edx, [eax + 1]
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
add eax, 1
cmp edx, eax
jne 0x43bb6a
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
add eax, edx
movzx ecx, byte [eax]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
add eax, 1
mov ebx, eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
add eax, edx
xor ecx, ebx
mov edx, ecx
mov byte [eax], dl
jmp 0x43bb27
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
add eax, 2
cmp edx, eax
jne 0x43bba0
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
add eax, edx
movzx ecx, byte [eax]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
add eax, 2
mov ebx, eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
add eax, edx
xor ecx, ebx
mov edx, ecx
mov byte [eax], dl
jmp 0x43bb27
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
cmp edx, eax
jne 0x43bbd1
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
add eax, edx
movzx ecx, byte [eax]
mov eax, dword [ebp - 0x24]
add eax, 0x77
mov ebx, eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
add eax, edx
xor ecx, ebx
mov edx, ecx
mov byte [eax], dl
jmp 0x43bc43
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
add eax, 4
cmp edx, eax
jne 0x43bc0a
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
add eax, edx
movzx ecx, byte [eax]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
add eax, 3
mov ebx, eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
add eax, edx
xor ecx, ebx
mov edx, ecx
mov byte [eax], dl
jmp 0x43bb27
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
add eax, 5
cmp edx, eax
jne 0x43bc43
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
add eax, edx
movzx ecx, byte [eax]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
add eax, 4
mov ebx, eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
add eax, edx
xor ecx, ebx
mov edx, ecx
mov byte [eax], dl
jmp 0x43bb27
add dword [ebp - 0x24], 1
jmp 0x43bb19
nop
mov eax, dword [ebp - 0x14]
mov byte [eax + 9], 1
mov eax, dword [ebp - 0x14]
lea ebx, [eax + 0xa]
nop
lea eax, [ebp - 0x3d]
mov ecx, eax
call fcn.00490728
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax + 9]
xor eax, 1
test al, al
je 0x43bdd3
mov eax, dword [ebp - 0x2c]
lea edx, [eax + 4]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
add ecx, 0xa
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0x3c]
cmp eax, 9
ja 0x43bdd2
jmp 0x43bcba
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
lea edx, [eax + 1]
mov eax, dword [ebp - 0x34]
mov dword [eax], edx
mov eax, dword [ebp - 0x34]
mov edx, dword [eax]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
add eax, 1
cmp edx, eax
jne 0x43bcf0
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
add eax, edx
movzx ecx, byte [eax]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
add eax, 1
mov esi, eax
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
add eax, edx
mov edx, esi
xor edx, ecx
mov byte [eax], dl
jmp 0x43bcad
mov eax, dword [ebp - 0x34]
mov edx, dword [eax]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
add eax, 2
cmp edx, eax
jne 0x43bd26
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
add eax, edx
movzx ecx, byte [eax]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
add eax, 2
mov esi, eax
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
add eax, edx
mov edx, esi
xor edx, ecx
mov byte [eax], dl
jmp 0x43bcad
mov eax, dword [ebp - 0x34]
mov edx, dword [eax]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
cmp edx, eax
jne 0x43bd57
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
add eax, edx
movzx ecx, byte [eax]
mov eax, dword [ebp - 0x3c]
add eax, 0x77
mov esi, eax
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
add eax, edx
mov edx, esi
xor edx, ecx
mov byte [eax], dl
jmp 0x43bdc9
mov eax, dword [ebp - 0x34]
mov edx, dword [eax]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
add eax, 4
cmp edx, eax
jne 0x43bd90
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
add eax, edx
movzx ecx, byte [eax]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
add eax, 3
mov esi, eax
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
add eax, edx
mov edx, esi
xor edx, ecx
mov byte [eax], dl
jmp 0x43bcad
mov eax, dword [ebp - 0x34]
mov edx, dword [eax]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
add eax, 5
cmp edx, eax
jne 0x43bdc9
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
add eax, edx
movzx ecx, byte [eax]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
add eax, 4
mov esi, eax
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
add eax, edx
mov edx, esi
xor edx, ecx
mov byte [eax], dl
jmp 0x43bcad
add dword [ebp - 0x3c], 1
jmp 0x43bc9f
nop
mov eax, dword [ebp - 0x2c]
mov byte [eax + 9], 1
mov eax, dword [ebp - 0x2c]
add eax, 0xa
nop
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x45], 0xba
mov word [ebp - 0x41], 0xff00
mov byte [ebp - 0x3f], 0xe2
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
mov dword [0x4fc040], edx
mov edx, dword [eax + 4]
mov dword [0x4fc044], edx
mov edx, dword [eax + 8]
mov dword [0x4fc048], edx
mov edx, dword [eax + 0xc]
mov dword [0x4fc04c], edx
mov edx, dword [eax + 0x10]
mov dword [0x4fc050], edx
mov edx, dword [eax + 0x14]
mov dword [0x4fc054], edx
mov edx, dword [eax + 0x18]
mov dword [0x4fc058], edx
mov eax, dword [eax + 0x1c]
mov dword [0x4fc05c], eax
lea eax, [ebp - 0x4c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x40
mov dword [esp + 4], 0x20
mov dword [esp], 0x4fc040
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
sub esp, 0x10
lea eax, [ebp - 0x45]
add eax, 1
mov edx, 0x4391d4
mov dword [eax], edx
lea eax, [ebp - 0x4c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x40
mov dword [esp + 4], 7
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
sub esp, 0x10
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x45]
mov dword [eax], edx
movzx edx, word [ebp - 0x41]
mov word [eax + 4], dx
movzx edx, byte [ebp - 0x3f]
mov byte [eax + 6], dl
mov eax, dword [ebp - 0x4c]
lea edx, [ebp - 0x4c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 7
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
sub esp, 0x10
mov eax, 0x4fc040
mov dword [0x4fc060], eax
nop
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret