Function at 0x431308
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor ebx, ebx
push ebx
push 1
lea eax, [ebp - 1]
push eax
push edi
push 0xffffffffffffffff
mov dword [ebp - 8], ebx
mov byte [ebp - 1], bl
call esi
test eax, eax
je 0x43151d
cmp byte [ebp - 1], 0xe9
mov eax, edi
jne 0x431423
call fcn.004312c3
cmp eax, 0x1e
jb 0x43151a
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x1e
push edi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x43151a
push 0x23
push 0xffffffffffffff90
lea eax, [ebp - 0x30]
push eax
call fcn.0042b138
push ebx
push 0x1e
lea eax, [ebp - 0x30]
push eax
push edi
push 0xffffffffffffffff
call esi
test eax, eax
je 0x431508
xor esi, esi
lea ebx, [ebp - 0x30]
push esi
mov eax, ebx
push eax
jmp 0x4313c1
add esi, eax
cmp esi, 0x1e
ja 0x431508
mov cl, byte [ebx]
cmp cl, 0xe9
je 0x4313a8
cmp cl, 0xe8
jne 0x4313b5
cmp eax, 5
jne 0x4313b5
mov eax, edi
sub eax, dword [ebp + 0xc]
add dword [ebx + 1], eax
push 0
cmp esi, 5
jae 0x4313d0
lea ebx, [ebp + esi - 0x30]
push ebx
call fcn.00426a40
cmp eax, 0xffffffff
jne 0x431391
jmp 0x431508
mov eax, edi
sub eax, dword [ebp + 0xc]
lea ebx, [esi + 5]
sub eax, 5
mov dword [ebp + esi - 0x2f], eax
push ebx
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 0xc]
mov byte [ebp + esi - 0x30], 0xe9
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0xffffffffffffffff
call esi
test eax, eax
je 0x431508
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
sub eax, edi
sub eax, 5
mov ecx, edi
mov byte [ebp - 0x30], 0xe9
mov dword [ebp - 0x2f], eax
call fcn.00410d4f
push 0
push 5
lea eax, [ebp - 0x30]
jmp 0x4314fb
call fcn.004312c3
cmp eax, 0x1e
jb 0x43151a
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x1e
push edi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x43151a
push 0x24
push 0xffffffffffffff90
lea eax, [ebp - 0x30]
push eax
call fcn.0042b138
push ebx
push 0x1e
lea eax, [ebp - 0x30]
push eax
push edi
push 0xffffffffffffffff
call esi
test eax, eax
je 0x431508
xor esi, esi
lea ebx, [ebp - 0x30]
push esi
mov eax, ebx
push eax
jmp 0x4314a6
add esi, eax
cmp esi, 0x1e
ja 0x431508
mov cl, byte [ebx]
cmp cl, 0xe9
je 0x43148d
cmp cl, 0xe8
jne 0x43149a
cmp eax, 5
jne 0x43149a
mov eax, edi
sub eax, dword [ebp + 0xc]
add dword [ebx + 1], eax
push 0
cmp esi, 6
jae 0x4314b2
lea ebx, [ebp + esi - 0x30]
push ebx
call fcn.00426a40
cmp eax, 0xffffffff
jne 0x431476
jmp 0x431508
lea eax, [ebp + esi - 0x30]
lea ecx, [esi + edi]
lea ebx, [esi + 6]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push ebx
mov byte [eax], 0x68
mov dword [eax + 1], ecx
mov byte [eax + 5], 0xc3
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 0xc]
push 0xffffffffffffffff
call esi
test eax, eax
je 0x431508
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, edi
mov byte [ebp - 0x30], 0x68
mov dword [ebp - 0x2f], eax
mov byte [ebp - 0x2b], 0xc3
call fcn.00410d4f
push 0
push 6
lea eax, [ebp - 0x30]
push eax
push edi
push 0xffffffffffffffff
call esi
test eax, eax
je 0x431508
mov dword [ebp - 8], ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push 0x1e
push edi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [ebp - 8]
pop esi
pop ebx
leave
ret 8