Function at 0x10004e10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x28
push ebp
mov ebp, dword [esp + 0x30]
mov ecx, dword [ebp + 0x3c]
cmp ecx, dword [esp + 0x34]
mov dword [esp + 4], ecx
jae 0x1000506f
xor eax, eax
cmp ecx, eax
je 0x1000506f
cmp dword [ecx + ebp], 0x4550
jne 0x1000506f
cmp word [ecx + ebp + 4], 0x14c
jne 0x1000506f
cmp word [ecx + ebp + 0x18], 0x10b
jne 0x1000506f
push ebx
movzx ebx, word [ecx + ebp + 6]
push esi
push edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov esi, dword [ecx + ebp + 0x34]
mov edi, dword [ecx + ebp + 0x50]
push 0x1c
lea eax, [esp + 0x20]
push eax
push esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp dword [esp + 0x20], 0
jne 0x10004eba
cmp dword [esp + 0x30], 1
jne 0x10004eba
cmp dword [esp + 0x2c], 0x10000
jne 0x10004eba
cmp dword [esp + 0x28], edi
ja 0x10004ebc
xor esi, esi
push 0x40
push 0x2000
push edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call esi
test eax, eax
je 0x1000505b
push 0x40
push 0x1000
push edi
push eax
call esi
mov esi, dword [esp + 0x10]
lea ecx, [ebx + ebx*4]
lea edx, [esi + ecx*8 + 0xf8]
push edx
mov edi, eax
push ebp
push edi
call sub.MSVCR80.dll_memcpy
add esp, 0xc
test ebx, ebx
jle 0x10004f25
lea esi, [esi + ebp + 0x10c]
mov eax, dword [esi - 4]
mov ecx, dword [esi]
mov edx, dword [esi - 8]
push eax
add ecx, ebp
push ecx
add edx, edi
push edx
call sub.MSVCR80.dll_memcpy
add esp, 0xc
add esi, 0x28
sub ebx, 1
jne 0x10004f06
mov eax, dword [esp + 0x10]
mov eax, dword [eax + ebp + 0x80]
add eax, edi
add eax, 0x10
cmp dword [eax], 0
mov dword [esp + 0x40], 1
je 0x10004fd0
mov ebp, eax
jmp 0x10004f50
cmp dword [esp + 0x40], 0
je 0x1000504a
mov eax, dword [ebp - 4]
add eax, edi
cmp byte [eax], 0
je 0x1000504a
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x1000504a
mov esi, dword [ebp]
add esi, edi
cmp dword [esi], 0
je 0x10004fbc
mov eax, dword [esi]
test eax, eax
js 0x10004f90
lea eax, [eax + edi + 2]
jmp 0x10004f95
and eax, 0xffff
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10004fad
mov dword [esi], eax
add esi, 4
cmp dword [esi], 0
jne 0x10004f84
jmp 0x10004fbc
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esp + 0x40], 0
add ebp, 0x14
cmp dword [ebp], 0
jne 0x10004f50
cmp dword [esp + 0x40], 0
je 0x1000504a
mov ebp, dword [esp + 0x3c]
mov edx, dword [esp + 0x10]
mov ecx, dword [edx + ebp + 0xa0]
add ecx, edi
cmp dword [ecx], 0
je 0x10005035
mov esi, dword [ecx + 4]
test esi, esi
je 0x10005035
add esi, 0xfffffff8
shr esi, 1
xor edx, edx
test esi, esi
jle 0x1000502d
jmp 0x10005000
movzx eax, word [ecx + edx*2 + 8]
mov ebx, eax
and ebx, 0xf000
cmp ebx, 0x3000
jne 0x10005026
and eax, 0xfff
add eax, edi
add eax, dword [ecx]
mov ebx, edi
sub ebx, dword [esp + 0x18]
add dword [eax], ebx
add edx, 1
cmp edx, esi
jl 0x10005000
add ecx, dword [ecx + 4]
cmp dword [ecx], 0
jne 0x10004fe2
mov eax, dword [esp + 0x10]
mov eax, dword [eax + ebp + 0x28]
push 0
push 1
add eax, edi
push edi
call eax
test eax, eax
jne 0x10005065
mov ecx, dword [esp + 0x14]
push 0x4000
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop esi
pop ebx
xor eax, eax
pop ebp
add esp, 0x28
ret
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x28
ret
xor eax, eax
pop ebp
add esp, 0x28
ret