Function at 0x443020
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
push edi
mov eax, 0x403c
push esi
push ebx
call fcn.00457320
sub esp, eax
cmp dword [ecx + 0x179a4], 2
mov ebp, ecx
jne 0x443052
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00442ea0
sub esp, 8
mov ecx, dword [esp + 0x4050]
test ecx, ecx
je 0x4434ad
mov ecx, dword [ebp + 0x17918]
cmp dword [esp + 0x4050], 0x3fff
mov esi, 0x4000
cmovbe esi, dword [esp + 0x4050]
lea edi, [esp + 0x30]
mov eax, dword [ecx]
mov dword [esp], edi
mov dword [esp + 4], esi
mov eax, dword [eax + 4]
call eax
sub esp, 8
cmp eax, 0x4000
mov ebx, eax
ja 0x44348a
cmp esi, eax
jl 0x44348a
test ebx, ebx
jle 0x44349e
mov eax, dword [esp + 0x4050]
mov edx, dword [esp + 0x4050]
sub eax, ebx
test edx, edx
cmovs eax, dword [esp + 0x4050]
mov dword [esp + 0x4050], eax
lea eax, [ebp + 0xe8]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x30]
mov dword [esp + 0x24], eax
add eax, ebx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x24]
nop
movzx eax, byte [eax]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x8fc]
mov eax, dword [eax + 8]
cmp byte [eax + 6], 0
je 0x4432a2
mov eax, dword [ebp + 0xec]
mov edx, dword [ebp + 0xf0]
add eax, 1
mov dword [ebp + 0xec], eax
xor eax, edx
cmp eax, 0xffffff
ja 0x443178
nop
lea esi, [esi]
mov ecx, dword [ebp + 0xe8]
shr edx, 0x18
mov eax, dword [ecx]
mov dword [esp], edx
mov eax, dword [eax]
call eax
mov edx, dword [ebp + 0xf0]
mov ecx, dword [ebp + 0xec]
xor eax, eax
sub esp, 4
shl edx, 8
shl ecx, 8
or dl, 0xff
test ecx, ecx
sete al
mov dword [ebp + 0xf0], edx
add eax, ecx
mov dword [ebp + 0xec], eax
xor eax, edx
cmp eax, 0xffffff
jbe 0x443130
lea eax, [ebp + 0xf4]
mov edi, 7
mov dword [esp + 0x1c], eax
mov esi, esi
lea edi, [edi]
mov eax, dword [ebp + 0x17904]
test eax, eax
je 0x4432b7
mov esi, dword [esp + 0x1c]
add eax, 0xa
mov dword [esp], esi
call eax
mov esi, dword [esp + 0x20]
mov ecx, edi
mov ebx, dword [ebp + 0xf0]
lea eax, [eax + eax + 1]
sar esi, cl
mov ecx, dword [ebp + 0xec]
mov edx, ebx
sub edx, ecx
mul edx
shrd eax, edx, 0x10
add eax, ecx
and esi, 1
je 0x443294
mov dword [ebp + 0xf0], eax
mov ebx, eax
xor ecx, ebx
cmp ecx, 0xffffff
ja 0x443238
lea esi, [esi]
mov ecx, dword [ebp + 0xe8]
shr ebx, 0x18
mov eax, dword [ecx]
mov dword [esp], ebx
mov eax, dword [eax]
call eax
mov ebx, dword [ebp + 0xf0]
mov edx, dword [ebp + 0xec]
xor eax, eax
sub esp, 4
shl ebx, 8
shl edx, 8
or bl, 0xff
test edx, edx
sete al
mov dword [ebp + 0xf0], ebx
add eax, edx
mov dword [ebp + 0xec], eax
xor eax, ebx
cmp eax, 0xffffff
jbe 0x4431f0
mov ecx, dword [esp + 0x1c]
mov dword [esp], esi
sub edi, 1
call fcn.0043b6f0
sub esp, 4
cmp edi, 0xffffffff
jne 0x443190
cmp byte [ebp + 0x179a8], 0
je 0x44327c
mov eax, dword [ebp + 0x90]
test eax, eax
je 0x443373
mov eax, dword [esp + 0x20]
lea ecx, [ebp + 0x74]
mov dword [esp], eax
call fcn.0043b070
sub esp, 4
add dword [esp + 0x24], 1
mov eax, dword [esp + 0x24]
cmp eax, dword [esp + 0x28]
jne 0x4430f0
jmp 0x443052
lea ecx, [eax + 1]
mov dword [ebp + 0xec], ecx
jmp 0x4431df
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.0041ef40
sub esp, 4
jmp 0x443253
mov eax, dword [ebp + 0x8fc]
imul ebx, dword [eax + 0x14], 0x64
mov eax, dword [ebp + 0x17908]
add ebx, 0x1000
and ebx, 0xfffff000
test eax, eax
je 0x4432eb
mov dword [ebp + 0x17904], 0
mov dword [ebp + 0x17908], 0
test ebx, ebx
jle 0x443327
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov dword [esp + 4], ebx
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub esp, 0x10
test eax, eax
mov dword [ebp + 0x17904], eax
je 0x443451
mov dword [ebp + 0x17908], ebx
mov ecx, dword [esp + 0x1c]
call fcn.00435830
mov ebx, eax
mov eax, dword [ebp + 0x17908]
cmp ebx, eax
jg 0x4433cb
cmp ebx, 0xe
mov eax, dword [ebp + 0x17904]
jle 0x44335c
test eax, eax
je 0x44335c
cmp dword [ebp + 0x17908], 0xe
jg 0x44319e
mov dword [esp], 0x4fb70c
call fcn.00402a80
mov eax, dword [ebp + 0x17904]
jmp 0x44319e
mov eax, dword [ebp + 0x17920]
mov edx, dword [ebp + 0x17924]
mov ecx, eax
shr ecx, 3
and ecx, 0x3c
add ecx, ebp
mov ebx, dword [ecx + 0x1793c]
shl ebx, 8
or ebx, dword [esp + 0x20]
add eax, 8
adc edx, 0
mov dword [ecx + 0x1793c], ebx
mov dword [ebp + 0x17920], eax
and eax, 0x1ff
test eax, eax
mov dword [ebp + 0x17924], edx
jne 0x44327c
lea ecx, [ebp + 0x17920]
call fcn.00425e80
jmp 0x44327c
mov edx, dword [ebp + 0x17904]
test edx, edx
je 0x44346c
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
sub esp, 0xc
mov dword [ebp + 0x17904], 0
mov dword [ebp + 0x17908], 0
test ebx, ebx
jle 0x443441
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov dword [esp + 4], ebx
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub esp, 0x10
test eax, eax
mov dword [ebp + 0x17904], eax
je 0x443472
mov dword [ebp + 0x17908], ebx
mov ecx, dword [esp + 0x1c]
call fcn.00435830
mov ebx, eax
jmp 0x443340
mov dword [ebp + 0x17908], 0
mov dword [esp], 0x4facf6
call fcn.00402a80
jmp 0x443327
test eax, eax
jne 0x4433f5
jmp 0x443409
mov dword [ebp + 0x17908], 0
mov dword [esp], 0x4facf6
call fcn.00402a80
jmp 0x443441
mov dword [esp], 0x4fb98c
call fcn.00402a80
test ebx, ebx
jg 0x4430b1
xor eax, eax
add esp, 0x403c
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov eax, 1
jmp 0x4434a0