Function at 0x532d60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x62819c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 0xc]
push esi
push edi
mov esi, dword [ecx]
xor edi, edi
mov dword [ebp - 0x3f8], ecx
mov dword [ebp - 0x3ec], eax
cmp dword [0x633708], edi
jne 0x532dbb
push 0x63370c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x633708], 1
push 0x63370c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
call fcn.005333e0
push dword [ebp - 0x3ec]
mov esi, eax
mov dword [ebp - 0x3d8], esi
call fcn.005333e0
mov dword [ebp - 0x3e8], eax
lea eax, [ebp - 0x3d0]
push 1
push eax
call fcn.00533820
add esp, 0x10
test eax, eax
je 0x5331a3
xor edi, edi
push 0x26
push esi
push 0
lea eax, [ebp - 0x3d0]
push esi
push eax
call fcn.00533700
mov ecx, eax
add esp, 0x14
test ecx, ecx
je 0x532e53
mov eax, dword [ecx + 0x11c]
cmp eax, 0x105
je 0x532e53
cmp eax, 0x101
je 0x532e53
cmp eax, 0x102
je 0x532e53
cmp eax, 0x103
je 0x532e53
cmp eax, 0x104
je 0x532e53
mov eax, dword [ecx + 0x128]
add edi, eax
add esi, eax
cmp edi, 5
jb 0x532e00
lea eax, [ebp - 0x3d0]
mov dword [ebp - 0x3e4], edi
push eax
call fcn.005336e0
mov esi, edi
add esp, 4
mov edi, 0
cmp esi, 5
jb 0x5331a3
push esi
push dword [ebp - 0x3d8]
call fcn.00533420
mov ecx, dword [ebp - 0x3d8]
add esp, 8
mov dword [ebp - 0x3ec], edi
cmp ecx, 0x80000000
jae 0x532ea7
mov dword [ebp - 0x3d4], 1
jmp 0x532eb3
lea eax, [ecx - 0x7fff0000]
mov dword [ebp - 0x3d4], eax
jae 0x532ec3
lea eax, [ecx + 0x7ff80000]
mov dword [ebp - 0x3dc], eax
jmp 0x532ecd
mov dword [ebp - 0x3dc], 0xfff80000
xor eax, eax
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x414], eax
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x40c], eax
mov dword [ebp - 0x408], eax
mov dword [ebp - 0x404], eax
mov dword [ebp - 0x400], eax
mov dword [ebp - 0x3fc], eax
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x3d4]
cmp eax, dword [ebp - 0x3dc]
jae 0x532fe6
push 0x1c
lea ecx, [ebp - 0x438]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x532f9f
cmp dword [ebp - 0x428], 0x10000
jne 0x532f85
mov eax, dword [ebp - 0x42c]
cmp eax, 0x70
jb 0x532f8b
mov ecx, dword [ebp - 0x400]
cmp eax, ecx
jb 0x532f8b
mov eax, dword [ebp - 0x3d4]
xor edx, edx
dec eax
add eax, ecx
div ecx
push 0x20
imul eax, ecx
push 0x3000
push 0x70
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
mov dword [ebp - 0x3ec], edi
test edi, edi
jne 0x532fa7
mov eax, dword [ebp - 0x42c]
add eax, dword [ebp - 0x438]
mov dword [ebp - 0x3d4], eax
cmp eax, dword [ebp - 0x3dc]
jb 0x532f24
test edi, edi
je 0x53319e
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x3e0]
push eax
push 0x40
push 0x70
push edi
call esi
mov eax, dword [0x633724]
inc dword [0x633728]
mov dword [edi], eax
lea eax, [ebp - 0x3e0]
push eax
push dword [ebp - 0x3e0]
mov dword [0x633724], edi
push 0x70
push edi
call esi
mov esi, dword [ebp - 0x3e4]
test edi, edi
je 0x53319e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x3e0]
mov dword [ebp - 0x3d4], eax
push ecx
push 0x40
push esi
push dword [ebp - 0x3d8]
mov dword [ebp - 0x3e0], 0
push eax
mov dword [ebp - 0x3dc], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x53318b
lea eax, [ebp - 0x3dc]
push eax
push 0x40
push 0x70
push edi
push dword [ebp - 0x3d4]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x533158
mov ecx, dword [ebp - 0x3d8]
lea eax, [edi + 0x30]
mov dword [ebp - 0x3f0], eax
xor edx, edx
lea eax, [edi + 0x50]
mov edi, dword [ebp - 0x3f0]
sub ecx, edi
mov dword [ebp - 0x3f4], eax
mov dword [ebp - 0x3f0], ecx
lea eax, [edx + edi]
mov cl, byte [ecx + eax]
mov byte [eax], cl
mov eax, dword [ebp - 0x3f4]
mov byte [eax + edx], cl
inc edx
mov ecx, dword [ebp - 0x3f0]
cmp edx, esi
jb 0x533075
mov eax, dword [ebp - 0x3d8]
add eax, esi
push eax
lea eax, [esi + edi]
push eax
call fcn.00532d10
mov edi, dword [ebp - 0x3e8]
add esp, 8
mov edx, dword [ebp - 0x3d8]
mov ecx, edi
sub ecx, edx
mov eax, edx
sub eax, edi
cmp edi, edx
mov edi, dword [ebp - 0x3ec]
push dword [ebp - 0x3e8]
cmovae eax, ecx
cmp eax, 0x7fff0000
jbe 0x533105
lea esi, [edi + 0x10]
push esi
call fcn.00532d10
add esp, 8
sub eax, edi
sub eax, 0x10
push eax
push esi
push dword [ebp - 0x3d4]
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
push esi
push dword [ebp - 0x3d8]
call fcn.00532d10
mov esi, dword [ebp - 0x3e4]
jmp 0x53310b
push edx
call fcn.00532d10
mov eax, dword [ebp - 0x3d8]
add esp, 8
mov ecx, dword [ebp - 0x3f8]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x3e8]
mov dword [edi + 0xc], eax
lea eax, [edi + 0x30]
push esi
push eax
push dword [ebp - 0x3d4]
mov dword [edi + 8], esi
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 0x3dc]
push eax
push dword [ebp - 0x3dc]
push 0x70
push edi
push dword [ebp - 0x3d4]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push esi
push dword [ebp - 0x3d8]
push dword [ebp - 0x3d4]
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 0x3e0]
push eax
push dword [ebp - 0x3e0]
push esi
push dword [ebp - 0x3d8]
push dword [ebp - 0x3d4]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp dword [edi + 4], 0
jne 0x53319e
push 1
push edi
call fcn.00533660
add esp, 8
xor edi, edi
call fcn.00533350
push 0x63370c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
xor eax, eax
test edi, edi
pop edi
setne al
xor ecx, ebp
pop esi
call fcn.00545ec7
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret