Function at 0x43c620
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x46300c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.0043c1f0
push 0x40
push 0x3000
push 0x3e8
push 0
push dword [0x4638a4]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edx, eax
mov dword [0x463b5c], edx
test edx, edx
jne 0x43c67b
push dword [0x4638a4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452309
mov esp, ebp
pop ebp
ret
mov eax, 0x43c460
mov ecx, 0x43c450
sub eax, 0x43c450
sub ecx, 0x43c440
mov dword [ebp - 0x14], eax
mov ebx, 0x43c570
mov eax, 0x43c470
mov dword [ebp - 0x18], ecx
sub eax, 0x43c460
mov edi, 0x43c5e0
mov dword [ebp - 0x1c], eax
mov esi, 0x43c610
mov eax, 0x43c490
sub ebx, 0x43c560
sub eax, 0x43c470
sub edi, 0x43c570
mov dword [ebp - 0x20], eax
sub esi, 0x43c5e0
mov eax, 0x43c4a0
sub eax, 0x43c490
mov dword [ebp - 0x24], eax
mov eax, 0x43c4b0
sub eax, 0x43c4a0
mov dword [ebp - 0x28], eax
mov eax, 0x43c4d0
sub eax, 0x43c4b0
mov dword [ebp - 0x2c], eax
mov eax, 0x43c4e0
sub eax, 0x43c4d0
mov dword [ebp - 0x30], eax
mov eax, 0x43c4f0
sub eax, 0x43c4e0
mov dword [ebp - 0x34], eax
mov eax, 0x43c510
sub eax, 0x43c4f0
mov dword [ebp - 0x38], eax
mov eax, 0x43c520
sub eax, 0x43c510
mov dword [ebp - 0x3c], eax
mov eax, 0x43c530
sub eax, 0x43c520
mov dword [ebp - 0x40], eax
mov eax, 0x43c540
push 0
push ecx
sub eax, 0x43c530
push 0x43c440
mov dword [ebp - 0x44], eax
mov eax, 0x43c560
push edx
push dword [0x4638a4]
sub eax, 0x43c540
mov dword [ebp - 0x48], eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [0x463b5c]
add eax, dword [ebp - 0x18]
push 0
push dword [ebp - 0x14]
push 0x43c450
push eax
push dword [0x4638a4]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [0x463b5c]
add eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
push 0
push dword [ebp - 0x1c]
push 0x43c460
push eax
push dword [0x4638a4]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [0x463b5c]
add eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
push 0
push dword [ebp - 0x20]
push 0x43c470
push eax
push dword [0x4638a4]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [0x463b5c]
add eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
push 0
push dword [ebp - 0x24]
push 0x43c490
push eax
push dword [0x4638a4]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [0x463b5c]
add eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
push 0
push dword [ebp - 0x28]
push 0x43c4a0
push eax
push dword [0x4638a4]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [0x463b5c]
add eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
push 0
push dword [ebp - 0x2c]
push 0x43c4b0
push eax
push dword [0x4638a4]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [0x463b5c]
add eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
push 0
push dword [ebp - 0x30]
push 0x43c4d0
push eax
push dword [0x4638a4]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [0x463b5c]
add eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
push 0
push dword [ebp - 0x34]
push 0x43c4e0
push eax
push dword [0x4638a4]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [0x463b5c]
add eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
push 0
push dword [ebp - 0x38]
push 0x43c4f0
push eax
push dword [0x4638a4]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [0x463b5c]
add eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
push 0
push dword [ebp - 0x3c]
push 0x43c510
push eax
push dword [0x4638a4]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [0x463b5c]
add eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
push 0
push dword [ebp - 0x40]
push 0x43c520
push eax
push dword [0x4638a4]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [0x463b5c]
add eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
push 0
push dword [ebp - 0x44]
push 0x43c530
push eax
push dword [0x4638a4]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [0x463b5c]
add eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
push 0
push dword [ebp - 0x48]
push 0x43c540
push eax
push dword [0x4638a4]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [0x463b5c]
add eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x40]
push 0
push ebx
push 0x43c560
add eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
push eax
push dword [0x4638a4]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [0x463b5c]
add eax, ebx
add eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
push 0
push edi
push 0x43c570
push eax
push dword [0x4638a4]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [0x463b5c]
add eax, edi
add eax, ebx
add eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
push 0
push esi
push 0x43c5e0
push eax
push dword [0x4638a4]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [0x463b5c]
add eax, esi
add eax, edi
add eax, ebx
add eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
push 0
push 4
push 0x43c610
push eax
push dword [0x4638a4]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call ebx
mov ecx, dword [0x463b5c]
push 0
push 4
lea eax, [ecx + 1]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ecx + 0x35]
push eax
push dword [0x4638a4]
call ebx
push 0
push 4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x463b5c]
add eax, 0x75
push eax
push dword [0x4638a4]
call ebx
push 0
push 4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x463b5c]
add eax, 0xb2
push eax
push dword [0x4638a4]
call ebx
push 0
push 4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x463b5c]
add eax, 0x132
push eax
push dword [0x4638a4]
call ebx
push 0
push 4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x463b5c]
add eax, 0x16e
push eax
push dword [0x4638a4]
call ebx
mov ecx, dword [0x463b5c]
push 0
push 4
lea eax, [ecx + 0x121]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ecx + 0x184]
push eax
push dword [0x4638a4]
call ebx
mov eax, dword [0x463b5c]
mov ecx, dword [0x4638ac]
sub eax, ecx
sub eax, 0x43c440
push 0
sub eax, 0x16d8e5
add eax, 0x43c470
push 1
mov dword [ebp - 8], eax
lea eax, [ecx + 0x16d8e0]
push 0x45cb64
push eax
push dword [0x4638a4]
call ebx
push 0
lea eax, [ebp - 8]
push 4
push eax
mov eax, dword [0x4638ac]
add eax, 0x16d8e1
push eax
push dword [0x4638a4]
call ebx
mov eax, dword [0x4638ac]
push 0
push 1
push 0x45cb68
add eax, 0x16d8e5
push eax
push dword [0x4638a4]
call ebx
mov eax, dword [0x463b5c]
mov ecx, dword [0x4638ac]
sub eax, ecx
sub eax, 0x43c440
push 0
sub eax, 0x16d8ec
add eax, 0x43c4b0
push 1
mov dword [ebp - 8], eax
lea eax, [ecx + 0x16d8e7]
push 0x45cb64
push eax
push dword [0x4638a4]
call ebx
push 0
push 4
lea eax, [ebp - 8]
push eax
mov eax, dword [0x4638ac]
add eax, 0x16d8e8
push eax
push dword [0x4638a4]
call ebx
mov eax, dword [0x4638ac]
push 0
push 1
push 0x45cb68
add eax, 0x16d8ec
push eax
push dword [0x4638a4]
call ebx
mov eax, dword [0x463b5c]
mov ecx, dword [0x4638ac]
sub eax, ecx
sub eax, 0x43c440
push 0
sub eax, 0x16d8f3
add eax, 0x43c4f0
push 1
mov dword [ebp - 8], eax
lea eax, [ecx + 0x16d8ee]
push 0x45cb64
push eax
push dword [0x4638a4]
call ebx
push 0
push 4
lea eax, [ebp - 8]
push eax
mov eax, dword [0x4638ac]
add eax, 0x16d8ef
push eax
push dword [0x4638a4]
call ebx
mov eax, dword [0x4638ac]
push 0
push 1
push 0x45cb68
add eax, 0x16d8f3
push eax
push dword [0x4638a4]
call ebx
mov eax, dword [0x463b5c]
mov ecx, dword [0x4638ac]
sub eax, ecx
sub eax, 0x43c440
sub eax, 0x16d8fa
add eax, 0x43c5e0
mov dword [ebp - 8], eax
push 0
push 1
push 0x45cb64
lea eax, [ecx + 0x16d8f5]
push eax
push dword [0x4638a4]
call ebx
push 0
push 4
lea eax, [ebp - 8]
push eax
mov eax, dword [0x4638ac]
add eax, 0x16d8f6
push eax
push dword [0x4638a4]
call ebx
mov eax, dword [0x4638ac]
push 0
push 1
push 0x45cb68
add eax, 0x16d8fa
push eax
push dword [0x4638a4]
call ebx
mov eax, dword [0x4638ac]
push 0
push 1
push 0x45cb64
add eax, 0xae247
mov dword [ebp - 8], 0xbf694
push eax
push dword [0x4638a4]
call ebx
push 0
push 4
lea eax, [ebp - 8]
push eax
mov eax, dword [0x4638ac]
add eax, 0xae248
push eax
push dword [0x4638a4]
call ebx
mov eax, dword [0x4638ac]
push 0
push 1
push 0x45cb68
add eax, 0xae24c
push eax
push dword [0x4638a4]
call ebx
mov eax, dword [0x4638ac]
push 0
push 1
push 0x45cb64
add eax, 0xad925
mov dword [ebp - 8], 0xbffbd
push eax
push dword [0x4638a4]
call ebx
push 0
push 4
lea eax, [ebp - 8]
push eax
mov eax, dword [0x4638ac]
add eax, 0xad926
push eax
push dword [0x4638a4]
call ebx
mov eax, dword [0x4638ac]
push 0
push 1
push 0x45cb68
add eax, 0xad92a
push eax
push dword [0x4638a4]
call ebx
mov eax, dword [0x4638ac]
push 0
push 1
mov dword [ebp - 8], 0xc33ac
add eax, 0xaa53d
push 0x45cb64
push eax
push dword [0x4638a4]
call ebx
push 0
push 4
lea eax, [ebp - 8]
push eax
mov eax, dword [0x4638ac]
add eax, 0xaa53e
push eax
push dword [0x4638a4]
call ebx
mov eax, dword [0x4638ac]
push 0
push 1
push 0x45cb68
add eax, 0xaa542
push eax
push dword [0x4638a4]
call ebx
mov eax, dword [0x4638ac]
push 0
push 1
push 0x45cb64
add eax, 0xa23ce
mov dword [ebp - 8], 0xcb522
push eax
push dword [0x4638a4]
call ebx
push 0
push 4
lea eax, [ebp - 8]
push eax
mov eax, dword [0x4638ac]
add eax, 0xa23cf
push eax
push dword [0x4638a4]
call ebx
mov eax, dword [0x4638ac]
push 0
push 3
push 0x45cb6c
add eax, 0xa23d3
push eax
push dword [0x4638a4]
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00452309
mov esp, ebp
pop ebp
ret