Function at 0x446c10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Parse pe header

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x160]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov byte [ebp - 8], dl
mov byte [ebp - 0xc], cl
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
xor eax, eax
push 0x446f22
push ebp
push 0x414de0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40
push dword [ebp - 4]
lea eax, [ebp - 0x54]
push eax
call fcn.00453560
cmp word [ebp - 0x54], 0x5a4d
jne 0x446c5f
jmp 0x446c74
mov eax, 0x7a3640
mov edx, str.BTMemoryLoadLibary:_dll_dos_header_is_not_valid
call fcn.00408bc0
jmp 0x446f17
push 0xf8
mov edx, dword [ebp - 0x18]
mov eax, edx
sar eax, 0x1f
push eax
push edx
mov eax, dword [ebp - 4]
call fcn.004460e0
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.00453560
cmp dword [ebp - 0x14c], 0x4550
jne 0x446ca6
jmp 0x446cbc
mov eax, 0x7a3640
mov edx, str.BTMemoryLoadLibary:_IMAGE_NT_SIGNATURE_is_not_valid
call fcn.00408bc0
jmp 0x446f17
push 0x40
push 0x2000
push dword [ebp - 0xfc]
push dword [ebp - 0x118]
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0
je 0x446ce5
jmp 0x446d00
push 0x40
push 0x2000
push dword [ebp - 0xfc]
push 0
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 0x150], eax
nop
cmp dword [ebp - 0x150], 0
je 0x446d0b
jmp 0x446d20
mov eax, 0x7a3640
mov edx, str.BTMemoryLoadLibary:_VirtualAlloc_failed
call fcn.00408bc0
jmp 0x446f17
push 0x11
push 0
call sub.kernel32.dll_GetProcessHeap
push eax
call sub.kernel32.dll_HeapAlloc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x150]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x14]
mov dword [eax + 0xc], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0x14]
mov byte [eax + 0x10], 0
push 0x40
push 0x1000
push dword [ebp - 0xfc]
push dword [ebp - 0x150]
call sub.kernel32.dll_VirtualAlloc
push 0x40
push 0x1000
push dword [ebp - 0xf8]
push dword [ebp - 0x150]
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 0x154], eax
mov edx, dword [ebp - 0x18]
mov eax, edx
sar eax, 0x1f
mov ecx, dword [ebp - 0xf8]
mov ebx, 0
add edx, ecx
adc eax, ebx
push edx
push dword [ebp - 4]
push dword [ebp - 0x154]
call fcn.00453560
mov edx, dword [ebp - 0x18]
mov eax, edx
sar eax, 0x1f
mov ecx, dword [ebp - 0x154]
mov ebx, 0
add edx, ecx
adc eax, ebx
mov eax, dword [ebp - 0x14]
mov dword [eax], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x150]
mov edx, 0
mov dword [ecx + 0x34], eax
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x14c]
mov eax, dword [ebp - 4]
call fcn.00446320
mov edx, dword [ebp - 0x118]
mov ecx, 0
mov eax, dword [ebp - 0x150]
mov ebx, 0
sub eax, edx
sbb ebx, ecx
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
jne 0x446e20
jmp 0x446e30
push dword [ebp - 0x158]
push dword [ebp - 0x14]
call fcn.004464e0
mov esi, esi
push dword [ebp - 0x14]
call fcn.00446640
test al, al
je 0x446e3e
jmp 0x446e5c
push 0
mov edx, dword [0x7a3640]
mov eax, 0x7a3640
mov ecx, str._BTMemoryLoadLibary:_BuildImportTable_failed
call fcn.00408cc0
call fcn.0046ff00
mov esi, esi
movzx eax, byte [ebp - 8]
push eax
push dword [ebp - 0x14]
call fcn.00446a70
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
jne 0x446e79
jmp 0x446f0c
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
mov edx, 0
mov ebx, dword [ebp - 0x150]
mov ecx, 0
add eax, ebx
adc edx, ecx
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0
je 0x446ea6
jmp 0x446ebc
mov eax, 0x7a3640
mov edx, str.BTMemoryLoadLibary:_Get_DLLEntyPoint_failed
call fcn.00408bc0
call fcn.0046ff00
mov esi, esi
cmp byte [ebp - 0xc], 0
jne 0x446ec4
jmp 0x446f04
push 0
push 1
mov eax, dword [ebp - 0x150]
mov edx, 0
push eax
call dword [ebp - 0x15c]
or eax, eax
setne al
mov byte [ebp - 0x160], al
cmp byte [ebp - 0x160], 0
je 0x446ef0
jmp 0x446f04
mov eax, 0x7a3640
mov edx, str.BTMemoryLoadLibary:_Cant_attach_library
call fcn.00408bc0
call fcn.0046ff00
mov eax, dword [ebp - 0x14]
mov byte [eax + 0x10], 1
nop
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
jmp 0x446f3a
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
jmp 0x446f40
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8