Function at 0x43ea10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x670180
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x19], 1
push str.ThreatScanner_Initialize
mov esi, dword [ebp + 8]
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call edi
mov dword [0x6e90c4], eax
xor ebx, ebx
cmp eax, ebx
jne 0x43ea66
mov byte [ebp - 0x19], bl
push str.ThreatScanner_EnumerateDatabaseRecords
push esi
call edi
mov dword [0x6e90c8], eax
cmp eax, ebx
jne 0x43ea7a
mov byte [ebp - 0x19], bl
push str.ThreatScanner_Uninitialize
push esi
call edi
mov dword [0x6e90cc], eax
cmp eax, ebx
jne 0x43ea8e
mov byte [ebp - 0x19], bl
push str.ThreatScanner_CreateInstance
push esi
call edi
mov dword [0x6e90d0], eax
cmp eax, ebx
jne 0x43eaa2
mov byte [ebp - 0x19], bl
push str.ThreatScanner_DestroyInstance
push esi
call edi
mov dword [0x6e90d4], eax
cmp eax, ebx
jne 0x43eab6
mov byte [ebp - 0x19], bl
push str.ThreatScanner_GetDatabaseInformation
push esi
call edi
mov dword [0x6e90d8], eax
cmp eax, ebx
jne 0x43eaca
mov byte [ebp - 0x19], bl
push str.ThreatScanner_GetLicenseInformation
push esi
call edi
mov dword [0x6e90dc], eax
cmp eax, ebx
jne 0x43eade
mov byte [ebp - 0x19], bl
push str.ThreatScanner_SetIntOption
push esi
call edi
mov dword [0x6e90e0], eax
cmp eax, ebx
jne 0x43eaf2
mov byte [ebp - 0x19], bl
push str.ThreatScanner_GetOption
push esi
call edi
mov dword [0x6e90e4], eax
cmp eax, ebx
jne 0x43eb06
mov byte [ebp - 0x19], bl
push str.ThreatScanner_SetScanPriority
push esi
call edi
mov dword [0x6e90e8], eax
cmp eax, ebx
jne 0x43eb1a
mov byte [ebp - 0x19], bl
push str.ThreatScanner_ScanObject
push esi
call edi
mov dword [0x6e90ec], eax
cmp eax, ebx
jne 0x43eb2e
mov byte [ebp - 0x19], bl
push str.ThreatScanner_SetScanCallback
push esi
call edi
mov dword [0x6e90f0], eax
cmp eax, ebx
jne 0x43eb42
mov byte [ebp - 0x19], bl
push str.ThreatScanner_ScanObjectByHandle
push esi
call edi
mov dword [0x6e90f8], eax
cmp eax, ebx
jne 0x43eb56
mov byte [ebp - 0x19], bl
push str.ThreatScanner_SetPasswordCallback
push esi
call edi
mov dword [0x6e90f4], eax
cmp eax, ebx
jne 0x43eb6a
mov byte [ebp - 0x19], bl
push str.ThreatScanner_ScanBuffer
push esi
call edi
mov dword [0x6e90fc], eax
cmp eax, ebx
jne 0x43eb88
mov byte [ebp - 0x19], bl
call fcn.0043e9b0
jmp 0x43ec6e
mov al, byte [ebp - 0x19]
cmp al, 1
jne 0x43ec4f
push str.ThreatScanner_ScanBufferEx
push esi
call edi
mov dword [0x6e9100], eax
mov byte [ebp - 0x19], 1
mov esi, dword [0x6e90d0]
cmp esi, ebx
je 0x43ec6e
mov dword [ebp - 4], ebx
add esi, 0xffffe969
cmp byte [esi], 0x8b
jne 0x43ec67
cmp byte [esi + 1], 0xe8
jne 0x43ec67
mov dword [ebp - 0x44], ebx
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
push 0x1c
lea eax, [ebp - 0x44]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp eax, ebx
je 0x43ec67
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, eax
lea ecx, [ebp - 0x28]
push ecx
push 0x40
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x43ec67
mov dword [ebp - 0x24], ebx
mov byte [ebp - 0x20], 0x31
mov byte [ebp - 0x1f], 0xed
lea edx, [ebp - 0x24]
push edx
push 2
lea eax, [ebp - 0x20]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebx, eax
push 0
mov ecx, dword [ebp - 0x28]
push ecx
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test ebx, ebx
je 0x43ec67
push 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
jmp 0x43ec67
test al, al
jne 0x43eba4
call fcn.0043e9b0
jmp 0x43ec6e
mov dword [ebp - 4], 0xfffffffe
mov al, byte [ebp - 0x19]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret