Function at 0x43bec0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Parse pe header

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x160]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov byte [ebp - 8], dl
mov byte [ebp - 0xc], cl
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
xor eax, eax
push 0x43c19a
push ebp
push 0x414de0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40
push dword [ebp - 4]
lea eax, [ebp - 0x54]
push eax
call fcn.004469e0
cmp word [ebp - 0x54], 0x5a4d
je 0x43bf24
mov eax, 0x673600
mov edx, str.BTMemoryLoadLibary:_dll_dos_header_is_not_valid
call fcn.00408bc0
jmp 0x43c18f
push 0xf8
mov edx, dword [ebp - 0x18]
mov eax, edx
sar eax, 0x1f
push eax
push edx
mov eax, dword [ebp - 4]
call fcn.0043b550
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.004469e0
cmp dword [ebp - 0x14c], 0x4550
je 0x43bf68
mov eax, 0x673600
mov edx, str.BTMemoryLoadLibary:_IMAGE_NT_SIGNATURE_is_not_valid
call fcn.00408bc0
jmp 0x43c18f
push 0x40
push 0x2000
push dword [ebp - 0xfc]
push dword [ebp - 0x118]
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 0x150], eax
test eax, eax
jne 0x43bfa4
push 0x40
push 0x2000
push dword [ebp - 0xfc]
push 0
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0
jne 0x43bfc4
mov eax, 0x673600
mov edx, str.BTMemoryLoadLibary:_VirtualAlloc_failed
call fcn.00408bc0
jmp 0x43c18f
push 0x11
push 0
call sub.kernel32.dll_GetProcessHeap
push eax
call sub.kernel32.dll_HeapAlloc
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x150]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x14]
mov dword [eax + 0xc], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0x14]
mov byte [eax + 0x10], 0
push 0x40
push 0x1000
push dword [ebp - 0xfc]
push dword [ebp - 0x150]
call sub.kernel32.dll_VirtualAlloc
push 0x40
push 0x1000
push dword [ebp - 0xf8]
push dword [ebp - 0x150]
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 0x154], eax
mov edx, dword [ebp - 0x18]
mov eax, edx
sar eax, 0x1f
mov ecx, dword [ebp - 0xf8]
mov ebx, 0
add edx, ecx
adc eax, ebx
push edx
push dword [ebp - 4]
push dword [ebp - 0x154]
call fcn.004469e0
mov edx, dword [ebp - 0x18]
mov eax, edx
sar eax, 0x1f
mov ecx, dword [ebp - 0x154]
mov ebx, 0
add edx, ecx
adc eax, ebx
mov eax, dword [ebp - 0x14]
mov dword [eax], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x150]
xor edx, edx
mov dword [ecx + 0x34], eax
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x14c]
mov eax, dword [ebp - 4]
call fcn.0043b6f0
mov edx, dword [ebp - 0x118]
xor ecx, ecx
mov eax, dword [ebp - 0x150]
mov ebx, 0
sub eax, edx
sbb ebx, ecx
mov dword [ebp - 0x158], eax
test eax, eax
je 0x43c0c4
push dword [ebp - 0x158]
push dword [ebp - 0x14]
call fcn.0043b870
mov esi, esi
push dword [ebp - 0x14]
call fcn.0043b9b0
test al, al
jne 0x43c0ec
push 0
mov edx, dword [0x673600]
mov eax, 0x673600
mov ecx, str._BTMemoryLoadLibary:_BuildImportTable_failed
call fcn.00408cc0
call fcn.00462f50
movzx eax, byte [ebp - 8]
push eax
push dword [ebp - 0x14]
call fcn.0043bd60
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x43c184
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
xor edx, edx
mov ebx, dword [ebp - 0x150]
mov ecx, 0
add eax, ebx
adc edx, ecx
mov dword [ebp - 0x15c], eax
test eax, eax
jne 0x43c140
mov eax, 0x673600
mov edx, str.BTMemoryLoadLibary:_Get_DLLEntyPoint_failed
call fcn.00408bc0
call fcn.00462f50
nop
cmp byte [ebp - 0xc], 0
je 0x43c17c
push 0
push 1
mov eax, dword [ebp - 0x150]
xor edx, edx
push eax
call dword [ebp - 0x15c]
or eax, eax
setne al
mov byte [ebp - 0x160], al
test al, al
jne 0x43c17c
mov eax, 0x673600
mov edx, str.BTMemoryLoadLibary:_Cant_attach_library
call fcn.00408bc0
call fcn.00462f50
mov eax, dword [ebp - 0x14]
mov byte [eax + 0x10], 1
nop
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
jmp 0x43c1a9
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
jmp 0x43c1af
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8