Function at 0x43ef10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x450040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [0x4500e0]
push edi
mov edi, dword [0x454f8c]
add edi, dword [0x4500cc]
push str.NtReadVirtualMemory
push str.ntdll.dll
mov dword [ebp - 0x9c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 4
lea ecx, [ebp - 0x88]
push ecx
push edi
push esi
call eax
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 0
push 4
push edi
push esi
call ebx
mov edi, dword [ebp - 0x88]
mov esi, dword [0x4500e0]
add edi, 0x52a4
push str.NtReadVirtualMemory
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 4
lea ecx, [ebp - 0x8c]
push ecx
push edi
push esi
call eax
push 0
push 0
push 4
push edi
push esi
call ebx
mov edi, dword [ebp - 0x8c]
mov esi, dword [0x4500e0]
add edi, 0x40
push str.NtReadVirtualMemory
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 4
lea ecx, [ebp - 0x88]
push ecx
push edi
push esi
call eax
push 0
push 0
push 4
push edi
push esi
call ebx
mov edi, dword [ebp - 0x88]
mov esi, dword [0x4500e0]
add edi, 0xc
push str.NtReadVirtualMemory
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 4
lea ecx, [ebp - 0x94]
push ecx
push edi
push esi
call eax
push 0
push 0
push 4
push edi
push esi
call ebx
mov ebx, dword [ebp - 0x94]
xor esi, esi
add ebx, 0xc
mov dword [ebp - 0x88], ebx
nop dword [eax + eax]
mov edi, dword [0x4500e0]
push str.NtReadVirtualMemory
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 4
lea ecx, [ebp - 0x98]
push ecx
push ebx
push edi
call eax
push 0
push 0
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [ebp - 0x98]
push 0x80
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0x84]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov ebx, dword [0x4500e0]
add esp, 0xc
push str.NtReadVirtualMemory
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov dword [ebp - 0x8c], 0
lea eax, [ebp - 0x8c]
push eax
push 0x40
push 0x80
push dword [ebp - 0x90]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 0x80
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x90]
push ebx
call edi
push 0
push dword [ebp - 0x8c]
push 0x80
push dword [ebp - 0x90]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push dword [ebp - 0x9c]
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x43f16c
mov ebx, dword [ebp - 0x88]
inc esi
add ebx, 0x34
mov dword [ebp - 0x88], ebx
cmp esi, 0x400
jb 0x43f050
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004403ea
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004403ea
mov esp, ebp
pop ebp
ret 4