Function at 0x44e250
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sub.msvcrt.dll___iob_func
lea rcx, str.Mingw_w64_runtime_failure:_n
lea r9, [rax + 0x60]
mov r8d, 0x1b
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
call sub.msvcrt.dll___iob_func
lea rcx, [rax + 0x60]
mov rdx, rbx
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word cs:[rax + rax]
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
movsxd rbp, dword [0x00502684]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test ebp, ebp
jle 0x44e430
mov rax, qword [0x00502688]
xor r9d, r9d
add rax, 8
mov r10, qword [rax]
cmp rbx, r10
jb 0x44e2a0
mov rdx, qword [rax + 8]
mov r11d, dword [rdx + 8]
add r10, r11
cmp rbx, r10
jb 0x44e3e1
add r9d, 1
add rax, 0x18
cmp r9d, ebp
jne 0x44e284
mov rcx, rbx
call fcn.0044ef40
test rax, rax
mov r12, rax
je 0x44e454
lea rbp, [rbp + rbp*2]
lea r14, [rsp + 0x30]
shl rbp, 3
mov r13, rbp
add r13, qword [0x00502688]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call fcn.0044f060
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
mov rdx, r14
mov qword [r13 + 8], rax
mov rax, qword [0x00502688]
mov r13, qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov rcx, qword [rax + rbp + 8]
call r13
test rax, rax
je 0x44e437
mov eax, dword [rsp + 0x54]
cmp eax, 4
je 0x44e330
cmp eax, 0x40
jne 0x44e3f2
add dword [0x00502684], 1
mov r8d, 0x30
mov rdx, r14
mov rcx, rbx
call r13
test rax, rax
je 0x44e463
mov eax, dword [rsp + 0x54]
cmp eax, 4
je 0x44e35d
cmp eax, 0x40
jne 0x44e380
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp sub.msvcrt.dll_memcpy
lea r12, [rsp + 0x2c]
mov r8d, 0x40
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rbp, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r9, r12
call rbp
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call sub.msvcrt.dll_memcpy
mov eax, dword [rsp + 0x54]
cmp eax, 0x40
je 0x44e3d2
cmp eax, 4
je 0x44e3d2
mov r9, r12
mov r8d, dword [rsp + 0x2c]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
call rbp
nop
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea r14, [rsp + 0x30]
mov r13, qword [sym.imp.KERNEL32.dll_VirtualQuery]
jmp 0x44e337
mov r9, rbp
add r9, qword [0x00502688]
mov r8d, 0x40
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x44e330
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.0044e1e0
nop
xor ebp, ebp
jmp 0x44e2ad
mov rax, qword [0x00502688]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbp + 8]
call fcn.0044e1e0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.0044e1e0
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, rbx
mov edx, 0x30
call fcn.0044e1e0
nop
nop dword [rax + rax]
push rbp
push r14
push r13
push r12
push rdi
push rsi
push rbx
mov rbp, rsp
sub rsp, 0x60
mov ebx, dword [0x00502680]
test ebx, ebx
je 0x44e4b0
mov rsp, rbp
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop rbp
ret
mov dword [0x00502680], 1
call fcn.0044ef90
cdqe
lea rax, [rax + rax*2]
lea rax, [rax*8 + 0x1e]
and rax, 0xfffffffffffffff0
call fcn.0044f1b0
mov rsi, qword [0x004e15f0]
mov rbx, qword [0x004e1600]
sub rsp, rax
mov dword [0x00502684], 0
lea rax, [rsp + 0x20]
mov qword [0x00502688], rax
mov rax, rsi
sub rax, rbx
cmp rax, 7
jle 0x44e49b
cmp rax, 0xb
jle 0x44e535
mov r11d, dword [rbx]
test r11d, r11d
jne 0x44e660
mov r10d, dword [rbx + 4]
test r10d, r10d
jne 0x44e660
mov r9d, dword [rbx + 8]
test r9d, r9d
jne 0x44e54c
add rbx, 0xc
mov r8d, dword [rbx]
test r8d, r8d
jne 0x44e660
mov ecx, dword [rbx + 4]
test ecx, ecx
jne 0x44e660
mov edx, dword [rbx + 8]
cmp edx, 1
jne 0x44e76c
add rbx, 0xc
cmp rbx, rsi
jae 0x44e49b
mov r12, qword [0x004e1640]
lea r13, [rbp - 0x30]
movabs r14, 0xffffffff00000000
mov ecx, dword [rbx + 4]
mov eax, dword [rbx]
movzx edx, byte [rbx + 8]
add rax, r12
add rcx, r12
cmp edx, 0x10
mov r8, qword [rax]
je 0x44e6d6
jbe 0x44e69d
cmp edx, 0x20
je 0x44e71f
cmp edx, 0x40
jne 0x44e70b
sub r8, rax
mov rdx, r13
mov rdi, r13
mov rax, r8
add rax, qword [rcx]
mov r8d, 8
mov qword [rbp - 0x30], rax
call 0x44e250
add rbx, 0xc
cmp rbx, rsi
jb 0x44e57a
mov eax, dword [0x00502684]
xor ebx, ebx
xor esi, esi
test eax, eax
jle 0x44e49b
mov r14, qword [sym.imp.KERNEL32.dll_VirtualQuery]
lea r13, [rbp - 0x34]
mov r12, qword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x44e613
add esi, 1
add rbx, 0x18
cmp esi, dword [0x00502684]
jge 0x44e49b
mov rax, rbx
add rax, qword [0x00502688]
mov edx, dword [rax]
test edx, edx
je 0x44e600
mov rcx, qword [rax + 8]
mov r8d, 0x30
mov rdx, rdi
call r14
test rax, rax
je 0x44e74e
mov rax, qword [0x00502688]
mov r9, r13
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x30]
mov r8d, dword [rax + rbx]
call r12
jmp 0x44e600
cmp rbx, rsi
jae 0x44e49b
mov r12, qword [0x004e1640]
lea rdi, [rbp - 0x30]
mov ecx, dword [rbx + 4]
mov eax, dword [rbx]
mov r8d, 4
mov rdx, rdi
add rbx, 8
add rcx, r12
add eax, dword [rcx]
mov dword [rbp - 0x30], eax
call 0x44e250
cmp rbx, rsi
jb 0x44e674
jmp 0x44e5d4
cmp edx, 8
jne 0x44e70b
movzx edx, byte [rcx]
mov rdi, r13
mov r10, rdx
or r10, 0xffffffffffffff00
test dl, dl
cmovs rdx, r10
sub rdx, rax
lea rax, [r8 + rdx]
mov r8d, 1
mov rdx, r13
mov qword [rbp - 0x30], rax
call 0x44e250
jmp 0x44e5cb
movzx edx, word [rcx]
mov rdi, r13
mov r10, rdx
or r10, 0xffffffffffff0000
test dx, dx
cmovs rdx, r10
sub rdx, rax
lea rax, [r8 + rdx]
mov r8d, 2
mov rdx, r13
mov qword [rbp - 0x30], rax
call 0x44e250
jmp 0x44e5cb
lea rcx, str.__Unknown_pseudo_relocation_bit_size__d._n
mov qword [rbp - 0x30], 0
call fcn.0044e1e0
mov edx, dword [rcx]
mov rdi, r13
mov r10, rdx
or r10, r14
test edx, edx
cmovs rdx, r10
sub rdx, rax
lea rax, [r8 + rdx]
mov r8d, 4
mov rdx, r13
mov qword [rbp - 0x30], rax
call 0x44e250
jmp 0x44e5cb
add rbx, qword [0x00502688]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov rax, qword [rbx + 0x10]
mov r8, qword [rbx + 8]
mov edx, dword [rax + 8]
call fcn.0044e1e0
lea rcx, str.__Unknown_pseudo_relocation_protocol_version__d._n
call fcn.0044e1e0
nop
nop
nop
nop
nop
nop
nop
nop
sub rsp, 0x28
mov eax, dword [rcx]
cmp eax, 0xc0000091
ja 0x44e7f0
cmp eax, 0xc000008d
jae 0x44e80f
cmp eax, 0xc0000008
je 0x44e8b0
ja 0x44e880
cmp eax, 0x80000002
je 0x44e8b0
cmp eax, 0xc0000005
jne 0x44e88e
xor edx, edx
mov ecx, 0xb
call sub.msvcrt.dll_signal
cmp rax, 1
je 0x44e910
test rax, rax
je 0x44e8f0
mov ecx, 0xb
call rax
xor eax, eax
add rsp, 0x28
ret
cmp eax, 0xc0000094
je 0x44e8c0
ja 0x44e840
cmp eax, 0xc0000092
je 0x44e8b0
cmp eax, 0xc0000093
jne 0x44e88e
xor edx, edx
mov ecx, 8
call sub.msvcrt.dll_signal
cmp rax, 1
mov rdx, rax
je 0x44e898
test rdx, rdx
mov eax, 1
je 0x44e7e3
mov ecx, 8
call rdx
xor eax, eax
add rsp, 0x28
ret
cmp eax, 0xc0000095
je 0x44e8b0
cmp eax, 0xc0000096
jne 0x44e88e
xor edx, edx
mov ecx, 4
call sub.msvcrt.dll_signal
cmp rax, 1
je 0x44e8fa
test rax, rax
je 0x44e8f0
mov ecx, 4
call rax
xor eax, eax
jmp 0x44e7e3
cmp eax, 0xc000001d
je 0x44e84e
cmp eax, 0xc000008c
je 0x44e8b0
mov eax, 1
add rsp, 0x28
ret
mov edx, 1
mov ecx, 8
call sub.msvcrt.dll_signal
call fcn.0044e1b0
nop dword [rax]
xor eax, eax
add rsp, 0x28
ret
xor edx, edx
mov ecx, 8
call sub.msvcrt.dll_signal
cmp rax, 1
mov rdx, rax
jne 0x44e824
mov edx, 1
mov ecx, 8
call sub.msvcrt.dll_signal
xor eax, eax
jmp 0x44e7e3
mov eax, 4
add rsp, 0x28
ret
mov edx, 1
mov ecx, 4
call sub.msvcrt.dll_signal
xor eax, eax
jmp 0x44e7e3
mov edx, 1
mov ecx, 0xb
call sub.msvcrt.dll_signal
xor eax, eax
jmp 0x44e7e3