Function at 0x421d80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x88
mov eax, dword [0x50a4c0]
xor eax, esp
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x8c]
push ebx
push ebp
push esi
xor bl, bl
xor ebp, ebp
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], ecx
mov byte [esp + 0x17], bl
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], 0xffff
call fcn.00421d20
test eax, eax
je 0x421dfa
mov edx, dword [esp + 0x1c]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
cmp edi, ebp
je 0x422083
mov eax, dword [esp + 0x1c]
push eax
push 0xf0000
push edi
call fcn.004a7010
add esp, 0xc
jmp 0x421fe8
mov ecx, 0xb
mov esi, str.devicephysicalmemory
lea edi, [esp + 0x58]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
movsw word es:[edi], word [esi]
lea ecx, [esp + 0x58]
mov dword [esp + 0x86], eax
mov dword [esp + 0x8a], eax
mov dword [esp + 0x8e], eax
mov word [esp + 0x92], ax
mov dword [esp + 0x2c], ecx
mov edx, 0x2c
mov eax, 0x2e
lea ecx, [esp + 0x28]
push 0x4f0448
mov dword [esp + 0x3c], 0xf0000
mov dword [esp + 0x40], ebp
mov dword [esp + 0x24], ebp
mov word [esp + 0x2c], dx
mov word [esp + 0x2e], ax
mov dword [esp + 0x50], 0x40
mov dword [esp + 0x44], 0x18
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x48], ebp
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.ZwOpenSection
push esi
call edi
push str.ZwMapViewOfSection
push esi
mov ebp, eax
call edi
push str.ZwUnmapViewOfSection
push esi
mov ebx, eax
call edi
mov esi, eax
test ebp, ebp
je 0x421f2e
test ebx, ebx
je 0x421f2e
test esi, esi
je 0x421f2e
lea edx, [esp + 0x40]
push edx
push 4
lea eax, [esp + 0x3c]
push eax
call ebp
test eax, eax
jne 0x421f2e
push 2
push eax
push 1
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x44]
lea edx, [esp + 0x48]
push edx
push 0xffff
push eax
lea eax, [esp + 0x3c]
push eax
push 0xffffffffffffffff
push ecx
call ebx
test eax, eax
jne 0x421f2e
mov edx, dword [esp + 0x1c]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x18], eax
test eax, eax
je 0x421f20
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
push ecx
push edx
push eax
call fcn.004a7010
add esp, 0xc
mov eax, dword [esp + 0x20]
push eax
push 0xffffffffffffffff
call esi
jmp 0x421fe2
push 0x4f0490
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
cmp ebx, 0x20
jb 0x42205f
push str.GetSystemFirmwareTable
push ebx
call edi
mov edi, eax
test edi, edi
je 0x421fdb
push 0
push 0
push 0xe0000
push 0x4649524d
call edi
mov esi, eax
test esi, esi
je 0x421fdb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x421fdb
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebp, eax
test ebp, ebp
je 0x421fdb
push esi
push ebp
push 0xe0000
push 0x4649524d
call edi
test eax, eax
je 0x421fd4
cmp eax, esi
ja 0x421fd4
cmp eax, 0x1ffff
jb 0x421fd4
mov ecx, dword [esp + 0x1c]
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x18], eax
test eax, eax
je 0x421fd4
mov edx, dword [esp + 0x1c]
push edx
lea ecx, [ebp + 0x10000]
push ecx
push eax
call fcn.004a7010
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, dword [esp + 0x18]
xor ebp, ebp
cmp edi, ebp
je 0x42205f
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], edi
call fcn.00422090
add esp, 4
cmp eax, ebp
jne 0x422023
lea eax, [esp + 0x18]
push eax
call fcn.00422180
add esp, 4
cmp eax, ebp
jne 0x422023
lea ecx, [esp + 0x18]
push ecx
call fcn.00422270
add esp, 4
cmp eax, ebp
je 0x422050
cmp eax, 0x31
jae 0x42207c
mov esi, eax
cmp eax, ebp
jbe 0x422050
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
push esi
push edx
push eax
call fcn.004a7800
mov eax, dword [esp + 0x3c]
add esp, 0xc
cmp eax, ebp
je 0x42204b
mov dword [eax], esi
mov byte [esp + 0x17], 1
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004a4a25
add esp, 0x88
ret
mov esi, 0x31
jmp 0x42202e
mov al, bl
jmp 0x422063