Function at 0x46aaf0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Extract resource via kernel32 functions
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x344
mov eax, dword [0x5b00cc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5f49d0]
push ebx
push esi
push edi
xor ebx, ebx
push 0x58668c
push 0x65
push eax
mov dword [ebp - 0x328], ebx
mov dword [ebp - 0x330], ebx
mov dword [ebp - 0x32c], ebx
mov dword [ebp - 0x320], ebx
mov dword [ebp - 0x324], ebx
mov dword [ebp - 0x340], ebx
mov dword [ebp - 0x344], ebx
mov dword [ebp - 0x334], ebx
mov dword [ebp - 0x338], ebx
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
cmp eax, ebx
mov esi, dword [sym.imp.KERNEL32.DLL_LockResource]
je 0x46abd1
mov ecx, dword [0x5f49d0]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_LoadResource]
cmp eax, ebx
je 0x46abd1
push eax
call esi
mov edi, eax
push 4
lea edx, [ebp - 0x31c]
push edi
push edx
call fcn.00566500
mov eax, dword [ebp - 0x31c]
add esp, 0xc
cmp al, 0x50
jne 0x46abad
cmp ah, 0x49
jne 0x46abad
cmp byte [ebp - 0x31a], 0x43
jne 0x46abad
cmp byte [ebp - 0x319], 0x4b
jne 0x46abad
mov dword [ebp - 0x334], ebx
jmp 0x46abd1
push 4
lea eax, [ebp - 0x334]
push edi
push eax
call fcn.00566500
push 4
add edi, 4
lea ecx, [ebp - 0x338]
push edi
push ecx
call fcn.00566500
add esp, 0x18
mov edx, dword [0x5f49d0]
push str.LOADER
push 1
push edx
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
cmp eax, ebx
je 0x46ad36
push eax
mov eax, dword [0x5f49d0]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadResource]
cmp eax, ebx
je 0x46ad36
push eax
call esi
push 0x40
mov esi, eax
mov eax, dword [esi]
push 0x1000
push eax
push ebx
mov dword [0x5f29ac], eax
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov ecx, dword [0x5f29ac]
push ecx
lea edx, [esi + 4]
push edx
push eax
mov dword [0x5f4a78], eax
call fcn.0056b2f0
mov eax, dword [0x5f29ac]
lea esi, [esi + eax + 4]
mov eax, dword [esi]
push eax
mov dword [0x5f29a8], eax
call fcn.005663ab
mov ecx, dword [0x5f29a8]
push ecx
lea edx, [esi + 4]
push edx
push eax
mov dword [0x5f4a74], eax
call fcn.0056b2f0
mov eax, dword [0x5f29a8]
lea esi, [esi + eax + 4]
mov eax, dword [esi]
push eax
mov dword [ebp - 0x328], eax
call fcn.005663ab
mov ecx, dword [ebp - 0x328]
push ecx
lea edx, [esi + 4]
mov edi, eax
push edx
push edi
call fcn.0056b2f0
mov eax, dword [ebp - 0x328]
lea esi, [esi + eax + 4]
mov eax, dword [esi]
add esp, 0x2c
cmp eax, ebx
mov dword [ebp - 0x330], eax
jle 0x46acc7
push eax
call fcn.005663ab
mov ecx, dword [ebp - 0x330]
push ecx
lea edx, [esi + 4]
push edx
push eax
mov dword [0x5f4a7c], eax
call fcn.0056b2f0
mov eax, dword [ebp - 0x330]
add esp, 0x10
lea esi, [esi + eax + 4]
mov eax, dword [esi]
cmp eax, ebx
mov dword [ebp - 0x320], eax
jle 0x46acfd
push eax
call fcn.005663ab
mov ecx, dword [ebp - 0x320]
push ecx
lea edx, [esi + 4]
push edx
push eax
mov dword [ebp - 0x340], eax
call fcn.0056b2f0
mov eax, dword [ebp - 0x320]
add esp, 0x10
lea esi, [esi + eax + 4]
mov eax, dword [esi]
cmp eax, ebx
mov dword [ebp - 0x32c], eax
jle 0x46b2b1
push eax
call fcn.005663ab
mov ecx, dword [ebp - 0x32c]
push ecx
add esi, 4
push esi
push eax
mov dword [ebp - 0x324], eax
call fcn.0056b2f0
add esp, 0x10
jmp 0x46b2b1
cmp dword [ebp - 0x334], ebx
je 0x46b028
call fcn.0041a360
test al, al
mov eax, dword [0x5f49d0]
push 0x104
je 0x46ad82
lea edx, [ebp - 0x318]
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push ebx
push 0x80
push 3
push ebx
push 3
push SysReAllocString
lea ecx, [ebp - 0x318]
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
jmp 0x46adad
lea edx, [ebp - 0x110]
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push ebx
push 0x80
push 3
push ebx
push 3
push SysReAllocString
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x46ade1
xor esi, esi
push 0x27b
push str.........CommonloaderX86.cpp
mov edx, 0x57e0a8
lea ecx, [esi + 4]
call fcn.004f1fc0
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00566120
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x334]
push ebx
push ebx
push edx
push edi
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov esi, dword [sym.imp.KERNEL32.DLL_ReadFile]
push ebx
lea eax, [ebp - 0x31c]
push eax
push 6
lea ecx, [ebp - 0xc]
push ecx
push edi
call esi
push 6
mov eax, str.112358
mov ebx, 6
lea ecx, [ebp - 0xc]
call fcn.0052fca0
add esp, 4
test eax, eax
je 0x46ae85
push 2
mov edx, 0xfffffffa
sub edx, dword [ebp - 0x338]
push 0
push edx
push edi
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push 0
lea eax, [ebp - 0x31c]
push eax
push ebx
lea ecx, [ebp - 0xc]
push ecx
push edi
call esi
push ebx
mov eax, str.112358
lea ecx, [ebp - 0xc]
call fcn.0052fca0
add esp, 4
test eax, eax
je 0x46ae85
push 0x28c
push str.........CommonloaderX86.cpp
mov esi, str.Executable_is_corrupt_
mov edx, 0x57e0a8
lea ecx, [ebx - 2]
call fcn.004f1fc0
mov esi, dword [sym.imp.KERNEL32.DLL_ReadFile]
add esp, 8
push 0
lea edx, [ebp - 0x31c]
push edx
push 4
push 0x5f29ac
push edi
call esi
mov eax, dword [0x5f29ac]
push 0x40
push 0x1000
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov edx, dword [0x5f29ac]
push 0
lea ecx, [ebp - 0x31c]
push ecx
push edx
push eax
push edi
mov dword [0x5f4a78], eax
call esi
push 0
lea eax, [ebp - 0x31c]
push eax
push 4
push 0x5f29a8
push edi
call esi
mov ecx, dword [0x5f29a8]
push ecx
call fcn.005663ab
mov ecx, dword [0x5f29a8]
add esp, 4
push 0
lea edx, [ebp - 0x31c]
push edx
push ecx
push eax
push edi
mov dword [0x5f4a74], eax
call esi
push 0
lea edx, [ebp - 0x31c]
push edx
push 4
lea eax, [ebp - 0x328]
push eax
push edi
call esi
mov ecx, dword [ebp - 0x328]
push ecx
call fcn.005663ab
mov ecx, dword [ebp - 0x328]
add esp, 4
push 0
lea edx, [ebp - 0x31c]
push edx
push ecx
push eax
push edi
mov dword [ebp - 0x33c], eax
call esi
push 0
lea edx, [ebp - 0x31c]
push edx
push 4
lea eax, [ebp - 0x330]
push eax
push edi
call esi
mov eax, dword [ebp - 0x330]
test eax, eax
jle 0x46af80
push eax
call fcn.005663ab
mov edx, dword [ebp - 0x330]
add esp, 4
push 0
lea ecx, [ebp - 0x31c]
push ecx
push edx
push eax
push edi
mov dword [0x5f4a7c], eax
call esi
push 0
lea eax, [ebp - 0x31c]
push eax
push 4
lea ecx, [ebp - 0x320]
push ecx
push edi
call esi
cmp dword [ebp - 0x320], 0
jle 0x46afda
push 1
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov edx, dword [ebp - 0x320]
push edx
mov dword [ebp - 0x344], eax
call fcn.005663ab
mov edx, dword [ebp - 0x320]
add esp, 4
push 0
lea ecx, [ebp - 0x31c]
push ecx
push edx
push eax
push edi
mov dword [ebp - 0x340], eax
call esi
push 0
lea eax, [ebp - 0x31c]
push eax
push 4
lea ecx, [ebp - 0x32c]
push ecx
push edi
call esi
mov eax, dword [ebp - 0x32c]
test eax, eax
jle 0x46b01c
push eax
call fcn.005663ab
mov ecx, dword [ebp - 0x32c]
add esp, 4
push 0
lea edx, [ebp - 0x31c]
push edx
push ecx
push eax
push edi
mov dword [ebp - 0x324], eax
call esi
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x46b2ab
push ebx
push str.import.dat
mov dword [ebp - 0x33c], ebx
mov dword [ebp - 0x328], ebx
call dword [sym.imp.KERNEL32.DLL__lopen]
mov esi, dword [sym.imp.KERNEL32.DLL__llseek]
mov edi, eax
cmp edi, 0xffffffff
je 0x46b08d
push 2
push ebx
push edi
call esi
cmp eax, ebx
mov dword [ebp - 0x328], eax
jle 0x46b086
push ebx
push ebx
push edi
call esi
mov edx, dword [ebp - 0x328]
push edx
call fcn.005663ab
mov ecx, dword [ebp - 0x328]
add esp, 4
push ecx
push eax
push edi
mov dword [ebp - 0x33c], eax
call dword [sym.imp.KERNEL32.DLL__lread]
push edi
call dword [sym.imp.KERNEL32.DLL__lclose]
mov edx, dword [ebp - 0x33c]
push ebx
push str.code.dat
mov dword [ebp - 0x33c], edx
mov dword [ebp - 0x324], ebx
mov dword [0x5f29ac], ebx
call dword [sym.imp.KERNEL32.DLL__lopen]
mov edi, eax
cmp edi, 0xffffffff
je 0x46b0f6
push 2
push ebx
push edi
call esi
cmp eax, ebx
mov dword [0x5f29ac], eax
jle 0x46b0ef
push ebx
push ebx
push edi
call esi
mov eax, dword [0x5f29ac]
push eax
call fcn.005663ab
mov ecx, dword [0x5f29ac]
add esp, 4
push ecx
push eax
push edi
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.DLL__lread]
push edi
call dword [sym.imp.KERNEL32.DLL__lclose]
mov edx, dword [ebp - 0x324]
push ebx
push str.data.dat
mov dword [0x5f4a78], edx
mov dword [ebp - 0x324], ebx
mov dword [0x5f29a8], ebx
call dword [sym.imp.KERNEL32.DLL__lopen]
mov edi, eax
cmp edi, 0xffffffff
je 0x46b15f
push 2
push ebx
push edi
call esi
cmp eax, ebx
mov dword [0x5f29a8], eax
jle 0x46b158
push ebx
push ebx
push edi
call esi
mov eax, dword [0x5f29a8]
push eax
call fcn.005663ab
mov ecx, dword [0x5f29a8]
add esp, 4
push ecx
push eax
push edi
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.DLL__lread]
push edi
call dword [sym.imp.KERNEL32.DLL__lclose]
mov edx, dword [ebp - 0x324]
push ebx
push str.rsrc.dat
mov dword [0x5f4a74], edx
mov dword [ebp - 0x324], ebx
mov dword [ebp - 0x320], ebx
call dword [sym.imp.KERNEL32.DLL__lopen]
mov edi, eax
cmp edi, 0xffffffff
je 0x46b1ca
push 2
push ebx
push edi
call esi
cmp eax, ebx
mov dword [ebp - 0x320], eax
jle 0x46b1c3
push ebx
push ebx
push edi
call esi
mov eax, dword [ebp - 0x320]
push eax
call fcn.005663ab
mov ecx, dword [ebp - 0x320]
add esp, 4
push ecx
push eax
push edi
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.DLL__lread]
push edi
call dword [sym.imp.KERNEL32.DLL__lclose]
mov edx, dword [ebp - 0x324]
push ebx
push str.options.dat
mov dword [ebp - 0x340], edx
mov dword [ebp - 0x324], ebx
mov dword [ebp - 0x32c], ebx
call dword [sym.imp.KERNEL32.DLL__lopen]
mov edi, eax
cmp edi, 0xffffffff
je 0x46b235
push 2
push ebx
push edi
call esi
cmp eax, ebx
mov dword [ebp - 0x32c], eax
jle 0x46b22e
push ebx
push ebx
push edi
call esi
mov eax, dword [ebp - 0x32c]
push eax
call fcn.005663ab
mov ecx, dword [ebp - 0x32c]
add esp, 4
push ecx
push eax
push edi
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.DLL__lread]
push edi
call dword [sym.imp.KERNEL32.DLL__lclose]
mov edx, dword [ebp - 0x324]
push ebx
push str.symbols.dat
mov dword [ebp - 0x324], edx
mov dword [ebp - 0x330], ebx
call dword [sym.imp.KERNEL32.DLL__lopen]
mov edi, eax
cmp edi, 0xffffffff
je 0x46b2a3
push 2
push ebx
push edi
call esi
cmp eax, ebx
mov dword [ebp - 0x330], eax
jle 0x46b298
push ebx
push ebx
push edi
call esi
mov eax, dword [ebp - 0x330]
push eax
call fcn.005663ab
mov ecx, dword [ebp - 0x330]
add esp, 4
push ecx
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.DLL__lread]
push edi
call dword [sym.imp.KERNEL32.DLL__lclose]
jmp 0x46b2a5
push edi
mov esi, ebx
call dword [sym.imp.KERNEL32.DLL__lclose]
jmp 0x46b2a5
mov esi, ebx
mov dword [0x5f4a7c], esi
mov edi, dword [ebp - 0x33c]
mov edx, dword [ebp - 0x328]
push edx
mov ecx, edi
call fcn.00469c10
mov eax, dword [ebp - 0x344]
mov ecx, dword [ebp - 0x320]
mov edi, dword [ebp - 0x340]
push eax
push ecx
call fcn.0046a950
mov edx, dword [ebp - 0x32c]
mov ecx, dword [ebp - 0x324]
push edx
call fcn.0046a9b0
mov eax, dword [0x5f4a78]
add esp, 0x10
pushaw
call eax
popaw
mov ecx, dword [0x5f3a40]
test ecx, ecx
je 0x46b314
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov ecx, dword [0x5f3a40]
test ecx, ecx
jne 0x46b302
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00566120
mov esp, ebp
pop ebp
ret