Function at 0x43ea50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
mov eax, dword [0x450040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
mov dword [ebp - 0xc0], eax
call fcn.0043e840
mov dword [ebp - 0xa8], eax
mov cl, 0x64
mov al, cl
mov byte [ebp - 0x90], 0x1c
mov dl, cl
mov byte [ebp - 0x9c], 0x70
xor cl, byte [ebp - 0x90]
mov ah, al
mov byte [ebp - 0x8f], cl
mov bl, 0x23
mov cl, byte [ebp - 0x90]
mov ch, bl
xor al, cl
mov byte [ebp - 0x87], 0
xor dl, cl
mov byte [ebp - 0x89], al
xor ah, cl
mov byte [ebp - 0x8e], dl
mov dh, ch
mov byte [ebp - 0x88], ah
mov bh, ch
mov byte [ebp - 0x93], 0
xor ch, cl
mov byte [ebp - 0x87], 0
xor bl, cl
mov byte [ebp - 0x8c], ch
xor dh, cl
mov byte [ebp - 0x8d], bl
xor bh, cl
mov byte [ebp - 0x8b], dh
mov al, 0xfb
mov byte [ebp - 0x8a], bh
xor al, byte [ebp - 0x9c]
mov dl, 0x70
mov ah, dl
mov byte [ebp - 0x9b], al
mov al, byte [ebp - 0x9c]
mov ch, ah
xor ah, al
mov byte [ebp - 0x93], 0
mov bl, dl
mov byte [ebp - 0x97], ah
mov cl, 0x7d
mov dh, 0xb7
xor cl, al
xor dl, al
xor bl, al
mov byte [ebp - 0x9a], cl
xor ch, al
mov byte [ebp - 0x99], dl
xor dh, al
mov byte [ebp - 0x98], bl
mov bh, 0x75
mov byte [ebp - 0x96], ch
xor bh, al
mov byte [ebp - 0x95], dh
lea eax, [ebp - 0x8f]
mov byte [ebp - 0x94], bh
push eax
lea eax, [ebp - 0x9b]
push eax
push dword [0x4500d8]
push dword [0x4500d4]
call fcn.00418a20
mov esi, dword [0x4500e0]
push str.NtReadVirtualMemory
push str.ntdll.dll
lea edi, [eax + 2]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 4
lea ecx, [ebp - 0xa4]
push ecx
push edi
push esi
call eax
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 0
push 4
push edi
push esi
call ebx
mov edi, dword [ebp - 0xa4]
mov esi, dword [0x4500e0]
push str.NtReadVirtualMemory
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 4
lea ecx, [ebp - 0xa0]
push ecx
push edi
push esi
call eax
push 0
push 0
push 4
push edi
push esi
call ebx
mov edi, dword [ebp - 0xa0]
mov esi, dword [0x4500e0]
add edi, 0x34
push str.NtReadVirtualMemory
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 4
lea ecx, [ebp - 0xac]
push ecx
push edi
push esi
call eax
push 0
push 0
push 4
push edi
push esi
call ebx
mov eax, dword [ebp - 0xa8]
mov esi, dword [0x4500e0]
movzx ecx, al
mov eax, dword [ebp - 0xac]
push str.NtReadVirtualMemory
push str.ntdll.dll
lea edi, [eax + ecx*4]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 4
lea ecx, [ebp - 0xb0]
push ecx
push edi
push esi
call eax
push 0
push 0
push 4
push edi
push esi
call ebx
mov ebx, dword [ebp - 0xb0]
mov dword [ebp - 0xa4], ebx
test ebx, ebx
je 0x43ee60
nop
mov esi, dword [0x4500e0]
push str.NtReadVirtualMemory
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 4
lea ecx, [ebp - 0xb4]
push ecx
push ebx
push esi
call eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 0
push 4
push ebx
push esi
call eax
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0xb4], eax
jne 0x43ee0f
mov esi, dword [0x4500e0]
lea edi, [ebx + 4]
push str.NtReadVirtualMemory
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 4
lea ecx, [ebp - 0xb8]
push ecx
push edi
push esi
call eax
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 0
push 4
push edi
push esi
call ebx
mov eax, dword [ebp - 0xb8]
mov esi, dword [0x4500e0]
push str.NtReadVirtualMemory
push str.ntdll.dll
mov dword [ebp - 0xc8], eax
lea edi, [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 4
lea ecx, [ebp - 0xbc]
push ecx
push edi
push esi
call eax
push 0
push 0
push 4
push edi
push esi
call ebx
mov edi, dword [ebp - 0xbc]
mov ebx, dword [0x4500e0]
push str.NtReadVirtualMemory
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0xa0], 0
lea eax, [ebp - 0xa0]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0x40
push 0x80
push edi
push ebx
call eax
push 0
push 0x80
lea eax, [ebp - 0x84]
push eax
push edi
push ebx
call esi
push 0
push dword [ebp - 0xa0]
push 0x80
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [ebp - 0xc0]
lea ecx, [ebp - 0x84]
nop word [eax + eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x43ee00
test dl, dl
je 0x43edfc
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x43ee00
add ecx, 2
add eax, 2
test dl, dl
jne 0x43ede0
xor eax, eax
jmp 0x43ee05
sbb eax, eax
or eax, 1
test eax, eax
je 0x43ee75
mov ebx, dword [ebp - 0xa4]
mov esi, dword [0x4500e0]
lea edi, [ebx + 0xc]
push str.NtReadVirtualMemory
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 4
lea ecx, [ebp - 0xc4]
push ecx
push edi
push esi
call eax
push 0
push 0
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ebx, dword [ebp - 0xc4]
mov dword [ebp - 0xa4], ebx
test ebx, ebx
jne 0x43ec90
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004403ea
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc8]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004403ea
mov esp, ebp
pop ebp
ret 4