Function at 0x43fed0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x450040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
sub esp, 0x18
mov ecx, esp
push 0x45017c
call fcn.0040c9f0
lea eax, [ebp - 0x28]
push eax
call fcn.0043e590
xor ecx, ecx
mov byte [ebp - 8], 0
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ebp - 0x44], xmm0
mov dword [ebp - 0x38], eax
cmp byte [0x450113], cl
jne 0x4400f7
movaps xmm0, xmmword [0x4480b0]
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x69446f73
nop
mov al, byte [ebp - 0x1c]
xor byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 0x13
jb 0x43ff30
movd xmm0, dword [ebp - 0x44]
lea eax, [ebp - 0x1b]
cvtdq2ps xmm0, xmm0
push eax
mov byte [ebp - 8], 0
divss xmm0, dword [0x447cc0]
movss dword [ebp - 0x2c], xmm0
call fcn.0043ea50
mov ecx, dword [ebp - 0x2c]
mov edi, dword [0x4500e0]
xor ecx, eax
push str.NtWriteVirtualMemory
push str.ntdll.dll
mov dword [ebp - 0x34], ecx
lea ebx, [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
push eax
push 0x40
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x34]
push eax
push ebx
push edi
call esi
push 0
push dword [ebp - 0x2c]
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
movaps xmm0, xmmword [0x447f50]
xor ecx, ecx
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x4d755e42
mov byte [ebp - 8], 0
mov al, byte [ebp - 0x1c]
xor byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 0x13
jb 0x43ffd3
movd xmm0, dword [ebp - 0x40]
lea eax, [ebp - 0x1b]
cvtdq2ps xmm0, xmm0
push eax
mov byte [ebp - 8], 0
divss xmm0, dword [0x447cc0]
movss dword [ebp - 0x30], xmm0
call fcn.0043ea50
xor dword [ebp - 0x30], eax
mov edi, dword [0x4500e0]
push str.NtWriteVirtualMemory
push str.ntdll.dll
lea ebx, [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
push eax
push 0x40
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x30]
push eax
push ebx
push edi
call esi
push 0
push dword [ebp - 0x2c]
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
movaps xmm0, xmmword [0x447e20]
xor ecx, ecx
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x1b260d11
mov byte [ebp - 8], 0
mov al, byte [ebp - 0x1c]
xor byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 0x13
jb 0x440071
movd xmm0, dword [ebp - 0x38]
lea eax, [ebp - 0x1b]
cvtdq2ps xmm0, xmm0
push eax
mov byte [ebp - 8], 0
divss xmm0, dword [0x447cc0]
movss dword [ebp - 0x34], xmm0
call fcn.0043ea50
mov ecx, dword [ebp - 0x34]
mov edi, dword [0x4500e0]
xor ecx, eax
push str.NtWriteVirtualMemory
push str.ntdll.dll
mov dword [ebp - 0x30], ecx
lea ebx, [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
push eax
push 0x40
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x30]
push eax
push ebx
push edi
call esi
push 0
push dword [ebp - 0x2c]
jmp 0x4402e5
movaps xmm0, xmmword [0x448000]
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x4b664d51
nop dword [eax]
mov al, byte [ebp - 0x1c]
xor byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 0x13
jb 0x440110
mov eax, dword [ebp - 0x44]
neg eax
mov byte [ebp - 8], 0
movd xmm0, eax
lea eax, [ebp - 0x1b]
cvtdq2ps xmm0, xmm0
push eax
divss xmm0, dword [0x447cc0]
movss dword [ebp - 0x30], xmm0
call fcn.0043ea50
xor dword [ebp - 0x30], eax
mov edi, dword [0x4500e0]
push str.NtWriteVirtualMemory
push str.ntdll.dll
lea ebx, [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
push eax
push 0x40
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x30]
push eax
push ebx
push edi
call esi
push 0
push dword [ebp - 0x2c]
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
movaps xmm0, xmmword [0x448090]
xor ecx, ecx
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x734b607c
mov byte [ebp - 8], 0
mov al, byte [ebp - 0x1c]
xor byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 0x13
jb 0x4401b2
mov eax, dword [ebp - 0x40]
neg eax
mov byte [ebp - 8], 0
movd xmm0, eax
lea eax, [ebp - 0x1b]
cvtdq2ps xmm0, xmm0
push eax
divss xmm0, dword [0x447cc0]
movss dword [ebp - 0x34], xmm0
call fcn.0043ea50
mov ecx, dword [ebp - 0x34]
mov edi, dword [0x4500e0]
xor ecx, eax
push str.NtWriteVirtualMemory
push str.ntdll.dll
mov dword [ebp - 0x30], ecx
lea ebx, [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
push eax
push 0x40
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x30]
push eax
push ebx
push edi
call esi
push 0
push dword [ebp - 0x2c]
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
movaps xmm0, xmmword [0x447f90]
xor ecx, ecx
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x536e4559
mov byte [ebp - 8], 0
nop dword [eax]
mov al, byte [ebp - 0x1c]
xor byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 0x13
jb 0x440260
mov eax, dword [ebp - 0x38]
neg eax
mov byte [ebp - 8], 0
movd xmm0, eax
lea eax, [ebp - 0x1b]
cvtdq2ps xmm0, xmm0
push eax
divss xmm0, dword [0x447cc0]
movss dword [ebp - 0x34], xmm0
call fcn.0043ea50
mov ecx, dword [ebp - 0x34]
mov edi, dword [0x4500e0]
xor ecx, eax
push str.NtWriteVirtualMemory
push str.ntdll.dll
mov dword [ebp - 0x30], ecx
lea ebx, [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x38], 0
lea eax, [ebp - 0x38]
push eax
push 0x40
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x30]
push eax
push ebx
push edi
call esi
push 0
push dword [ebp - 0x38]
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004403ea
mov esp, ebp
pop ebp
ret