Function at 0x58f590
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x88
mov eax, dword [0x644904]
mov ecx, dword [esp + 0x94]
xor eax, esp
push ebx
push ebp
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x94]
push esi
xor ebp, ebp
push edi
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], ecx
mov byte [esp + 0x13], 0
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], 0xffff
call fcn.0058f210
test eax, eax
je 0x58f616
mov edx, dword [esp + 0x18]
push edx
push 8
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ebx, eax
cmp ebx, ebp
je 0x58f89b
mov ecx, dword [esp + 0x18]
mov eax, ecx
shr ecx, 2
mov esi, 0xf0000
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x58f81d
mov ecx, 0xb
mov esi, 0x61a52c
lea edi, [esp + 0x58]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor ecx, ecx
mov dword [esp + 0x86], ecx
mov dword [esp + 0x8a], ecx
mov dword [esp + 0x8e], ecx
lea edx, [esp + 0x58]
lea eax, [esp + 0x24]
push 0x61a520
mov dword [esp + 0x3c], 0xf0000
mov dword [esp + 0x40], ebp
mov word [esp + 0x96], cx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x2c], edx
mov word [esp + 0x28], 0x2c
mov word [esp + 0x2a], 0x2e
mov dword [esp + 0x50], 0x40
mov dword [esp + 0x44], 0x18
mov dword [esp + 0x4c], eax
mov dword [esp + 0x48], ebp
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], ebp
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
push 0x61a510
push esi
call edi
push 0x61a4fc
push esi
mov ebp, eax
call edi
push 0x61a4e4
push esi
mov ebx, eax
call edi
test ebp, ebp
mov esi, eax
mov dword [esp + 0x20], esi
je 0x58f75e
test ebx, ebx
je 0x58f75e
test esi, esi
je 0x58f75e
lea ecx, [esp + 0x40]
push ecx
push 4
lea edx, [esp + 0x34]
push edx
call ebp
test eax, eax
jne 0x58f75e
push 2
push eax
push 1
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x48]
push ecx
push 0xffff
push 0
lea edx, [esp + 0x38]
push edx
push 0xffffffffffffffff
push eax
call ebx
test eax, eax
jne 0x58f75e
mov ecx, dword [esp + 0x18]
push ecx
push 8
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
mov dword [esp + 0x14], eax
je 0x58f750
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push eax
push 0xffffffffffffffff
call esi
jmp 0x58f817
push 0x61a4d4
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov ebx, eax
cmp ebx, 0x20
jb 0x58f89b
push 0x61a4bc
push ebx
call edi
mov edi, eax
test edi, edi
je 0x58f810
push 0
push 0
push 0xe0000
push 0x4649524d
call edi
mov esi, eax
test esi, esi
je 0x58f810
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x58f810
push esi
push 0
call dword [sym.imp.kernel32.dll_LocalAlloc]
mov ebp, eax
test ebp, ebp
je 0x58f810
push esi
push ebp
push 0xe0000
push 0x4649524d
call edi
test eax, eax
je 0x58f809
cmp eax, esi
ja 0x58f809
cmp eax, 0x1ffff
jb 0x58f809
mov ecx, dword [esp + 0x18]
push ecx
push 8
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
mov dword [esp + 0x14], eax
je 0x58f809
mov ecx, dword [esp + 0x18]
mov edx, ecx
shr ecx, 2
lea esi, [ebp + 0x10000]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebp
call dword [sym.imp.kernel32.dll_LocalFree]
push ebx
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov ebx, dword [esp + 0x14]
xor ebp, ebp
cmp ebx, ebp
je 0x58f89b
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], ebx
call fcn.0058f270
add esp, 4
cmp eax, ebp
jne 0x58f858
lea ecx, [esp + 0x14]
push ecx
call fcn.0058f370
add esp, 4
cmp eax, ebp
jne 0x58f858
lea edx, [esp + 0x14]
push edx
call fcn.0058f470
add esp, 4
cmp eax, ebp
je 0x58f88c
mov esi, dword [esp + 0xa0]
cmp eax, esi
jae 0x58f865
mov esi, eax
cmp esi, ebp
jbe 0x58f88c
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x34]
push esi
push eax
push ecx
call dword [sym.imp.msvcr71.dll_memmove]
mov eax, dword [esp + 0x3c]
add esp, 0xc
cmp eax, ebp
je 0x58f887
mov dword [eax], esi
mov byte [esp + 0x13], 1
push ebx
push ebp
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [esp + 0x94]
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005c8895
add esp, 0x88
ret