Function at 0x43de50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x198
mov eax, dword [0x4fa36c]
xor eax, esp
mov dword [esp + 0x194], eax
mov eax, dword [esp + 0x1a0]
push ebx
mov ebx, dword [esp + 0x1a0]
push ebp
push esi
push edi
mov edi, ecx
xor esi, esi
push 0x40
lea ecx, [esp + 0x164]
push esi
push ecx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], eax
mov dword [esp + 0x30], esi
call fcn.004aef60
mov ebp, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
add esp, 0xc
push esi
push 0x40
lea edx, [esp + 0x168]
push edx
push edi
push ebx
call ebp
test eax, eax
je 0x43def7
push pe_nt_image_headers32
lea eax, [esp + 0x44]
push esi
push eax
call fcn.004aef60
mov edx, dword [esp + 0x1a8]
add esp, 0xc
push esi
push pe_nt_image_headers32
lea ecx, [esp + 0x48]
push ecx
lea eax, [edi + edx]
push eax
push ebx
call ebp
test eax, eax
je 0x43def7
cmp word [esp + 0x58], 0x10b
je 0x43df12
push 9
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
mov ecx, dword [esp + 0x1a4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004a9ce9
add esp, 0x198
ret
movzx edx, word [esp + 0x54]
mov eax, dword [esp + 0x19c]
xor ecx, ecx
cmp word [esp + 0x46], cx
mov dword [esp + 0x110], ecx
mov dword [esp + 0x114], ecx
mov dword [esp + 0x14], ecx
lea eax, [edx + eax + 0x18]
mov dword [esp + 0x1c], ecx
jbe 0x43e019
add edi, eax
jmp 0x43df54
mov esi, dword [esp + 0x24]
xor eax, eax
push eax
push 0x28
lea ecx, [esp + 0x140]
push ecx
push edi
push ebx
mov dword [esp + 0x14c], eax
mov dword [esp + 0x150], eax
mov dword [esp + 0x154], eax
mov dword [esp + 0x158], eax
mov dword [esp + 0x15c], eax
mov dword [esp + 0x160], eax
mov dword [esp + 0x164], eax
mov dword [esp + 0x168], eax
mov dword [esp + 0x16c], eax
mov dword [esp + 0x170], eax
call ebp
test eax, eax
je 0x43def7
cmp dword [esp + 0x118], 0
mov eax, dword [esp + 0x148]
jne 0x43dfeb
mov edx, dword [esp + 0xc0]
mov ecx, dword [esp + 0x144]
cmp edx, ecx
jb 0x43dfeb
lea esi, [eax + ecx]
cmp edx, esi
jae 0x43dfeb
mov dword [esp + 0x118], ecx
mov dword [esp + 0x11c], eax
mov edx, dword [esp + 0x14c]
add eax, edx
cmp dword [esp + 0x14], eax
jae 0x43dffe
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
movzx ecx, word [esp + 0x46]
add eax, 1
add edi, 0x28
cmp eax, ecx
mov dword [esp + 0x1c], eax
jb 0x43df50
mov ebp, dword [esp + 0x1b4]
mov edx, dword [esp + 0xc4]
lea eax, [ebp + ebp*4]
add eax, eax
add eax, eax
mov dword [esp + 0x20], eax
lea eax, [edx + eax + 0x1b]
and eax, 0xfffffff8
mov ebx, ebp
shl ebx, 4
add ebx, eax
xor esi, esi
test ebp, ebp
mov dword [esp + 0x38], eax
mov edi, ebx
mov dword [esp + 0x14], ebx
jbe 0x43e07e
mov eax, dword [esp + 0x30]
mov eax, dword [eax + esi*4]
lea edx, [eax + 1]
jmp 0x43e060
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x43e060
sub eax, edx
add eax, 4
and eax, 0xfffffffc
add esi, 1
add edi, eax
cmp esi, ebp
jb 0x43e051
mov dword [esp + 0x14], edi
push edi
call fcn.004a9a85
add esp, 4
test eax, eax
mov dword [esp + 0x18], eax
je 0x43e32c
push edi
push 0
push eax
call fcn.004aef60
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x70]
lea eax, [ecx + edx]
add eax, dword [esp + 0x6c]
add esp, 0xc
add eax, dword [esp + 0x5c]
add eax, dword [esp + 0x6c]
cmp ecx, eax
jae 0x43e0bc
mov ecx, eax
push edi
mov edi, dword [esp + 0x30]
call fcn.0043dd50
add esp, 4
test eax, eax
mov dword [esp + 0x3c], eax
je 0x43e31f
mov edi, dword [esp + 0x34]
mov esi, dword [esp + 0x2c]
sub eax, edi
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0xc0]
test eax, eax
mov dword [esp + 0x28], 0
je 0x43e145
mov edx, dword [esp + 0xc4]
lea ecx, [esp + 0x28]
push ecx
push 0x40
push edx
add eax, edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x43e31f
mov ecx, dword [esp + 0xc4]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
push 0
push ecx
mov ecx, dword [esp + 0xc8]
add edx, eax
push edx
add edi, ecx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x43e31f
xor edi, edi
test ebp, ebp
jbe 0x43e21d
mov esi, dword [esp + 0x18]
mov ebp, dword [esp + 0x38]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
add esi, 4
add edx, ebp
mov dword [esp + 0x20], edx
lea ebp, [eax + ebp + 4]
lea esp, [esp]
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx + edi*4]
mov ecx, dword [esp + 0x14]
sub ecx, ebx
cmp ecx, 0x7fffffff
ja 0x43e31f
mov edx, dword [esp + 0x18]
push ecx
add edx, ebx
call fcn.0043db50
test eax, eax
jl 0x43e31f
mov ecx, dword [esp + 0x20]
mov dword [esi - 4], ecx
mov dword [ebp], 0
mov eax, Ordinal_4
mov dword [ebp - 4], eax
lea edx, [ecx + 8]
mov dword [esi + 0xc], edx
mov edx, dword [esp + 0x30]
mov dword [ebp + 4], eax
xor eax, eax
mov dword [ebp + 8], eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov eax, dword [esp + 0x1c]
add eax, ebx
mov dword [esi + 8], eax
mov eax, dword [edx + edi*4]
lea edx, [eax + 1]
mov dword [esp + 0x38], edx
lea ecx, [ecx]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x43e1e0
sub eax, dword [esp + 0x38]
add edi, 1
add eax, 4
and eax, 0xfffffffc
add ecx, 0x10
add ebx, eax
add ebp, 0x10
add esi, 0x14
cmp edi, dword [esp + 0x1b4]
mov dword [esp + 0x20], ecx
jb 0x43e170
mov ebp, dword [esp + 0x1b4]
mov esi, dword [esp + 0x2c]
mov eax, 0xcccccccd
mul dword [esp + 0xc4]
shr edx, 4
xor ecx, ecx
add edx, ebp
je 0x43e24b
mov eax, dword [esp + 0x18]
cmp dword [eax], 0
jne 0x43e241
cmp dword [eax + 0x10], 0
je 0x43e24b
add ecx, 1
add eax, 0x14
cmp ecx, edx
jb 0x43e236
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x3c]
push 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
push ecx
push esi
call ebx
test eax, eax
je 0x43e31f
cmp dword [esp + 0x118], 0
jne 0x43e289
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x118], edx
mov dword [esp + 0x11c], eax
mov ecx, dword [esp + 0x1c]
mov edi, dword [esp + 0x34]
mov edx, dword [esp + 0x14]
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea eax, [esp + 0x28]
push eax
push 0x40
mov dword [esp + 0xc8], ecx
mov ecx, dword [esp + 0x9c]
push ecx
push edi
push esi
mov dword [esp + 0xd8], edx
call ebp
test eax, eax
je 0x43e31f
push 0
push 0x40
lea edx, [esp + 0x168]
push edx
push edi
push esi
mov dword [esp + 0xac], 0
call ebx
test eax, eax
je 0x43e31f
mov ecx, dword [esp + 0x19c]
push 0
push pe_nt_image_headers32
lea eax, [esp + 0x48]
push eax
lea edx, [edi + ecx]
push edx
push esi
call ebx
test eax, eax
je 0x43e31f
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x94]
lea eax, [esp + 0x28]
push eax
push ecx
push edx
push edi
push esi
call ebp
test eax, eax
je 0x43e31f
mov dword [esp + 0x24], 1
mov eax, dword [esp + 0x18]
push eax
call fcn.004a93cc
add esp, 4
mov eax, dword [esp + 0x24]
jmp 0x43def9