Function at 0x5251f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x1c
mov eax, dword [0x597c40]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0x2020], 1
push edi
mov al, 0x3c
jne 0x525254
mov dword [esi + 0x1ff8], 0x80878b
mov dword [esi + 0x1ffc], 0x46c70000
mov dword [esi + 0x2000], 0x1803c
mov dword [esi + 0x2004], 0x878bc300
mov dword [esi + 0x2008], 0x80
mov word [esi + 0x200c], 0x4689
mov byte [esi + 0x200e], al
jmp 0x525282
mov dword [esi + 0x200f], 0xc77c4f8b
mov dword [esi + 0x2013], 0x1653c46
mov dword [esi + 0x2017], 0x8bc30000
mov dword [esi + 0x201b], 0x4e897c4f
mov byte [esi + 0x201f], al
mov al, byte [esi + 0x2020]
mov byte [esp + 0x13], 0xe8
mov dword [esp + 0x20], 0x90909090
mov word [esp + 0x24], 0x9090
cmp al, 1
jne 0x52538c
mov eax, dword [esi + 0x1194]
push ebx
push ebx
push 0xf0
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, ebx
je 0x52537a
mov ecx, dword [0x5db724]
push 0x40
push 0x1000
push 0x19
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, dword [0x5db724]
mov ebp, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea edx, [esp + 0x1c]
push edx
mov edi, eax
push 0xe
lea eax, [esi + 0x1ff8]
push eax
push edi
push ecx
mov dword [esp + 0x30], ebx
call ebp
mov ecx, dword [esi + 0x1e24]
lea edx, [esp + 0x18]
push edx
mov edx, dword [0x5db724]
push 1
lea eax, [esp + 0x1b]
push eax
push ecx
push edx
mov dword [esp + 0x2c], ebx
call ebp
mov eax, dword [esi + 0x1e24]
lea ecx, [esp + 0x1c]
push ecx
push 4
sub edi, eax
lea edx, [esp + 0x1c]
push edx
inc eax
push eax
mov eax, dword [0x5db724]
sub edi, 5
push eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x30], ebx
call ebp
mov eax, dword [esi + 0x1e24]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [0x5db724]
push 4
lea edx, [esp + 0x28]
push edx
add eax, 5
push eax
push ecx
mov dword [esp + 0x2c], ebx
call ebp
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00504076
add esp, 0x1c
ret
lea edx, [esp + 0x14]
push edx
push 9
lea eax, [esi + 0x2006]
jmp 0x525477
cmp al, bl
jne 0x525490
mov eax, dword [esi + 0x1194]
push ebx
push ebx
push 0xf0
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, ebx
je 0x52546a
mov ecx, dword [0x5db724]
push 0x40
push 0x1000
push 0x14
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, dword [0x5db724]
mov ebp, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea edx, [esp + 0x14]
push edx
mov edi, eax
push 0xb
lea eax, [esi + 0x200f]
push eax
push edi
push ecx
mov dword [esp + 0x28], ebx
call ebp
mov ecx, dword [esi + 0x1e24]
lea edx, [esp + 0x18]
push edx
mov edx, dword [0x5db724]
push 1
lea eax, [esp + 0x1b]
push eax
push ecx
push edx
mov dword [esp + 0x2c], ebx
call ebp
mov eax, dword [esi + 0x1e24]
lea ecx, [esp + 0x14]
push ecx
push 4
sub edi, eax
lea edx, [esp + 0x24]
push edx
inc eax
push eax
mov eax, dword [0x5db724]
sub edi, 5
push eax
mov dword [esp + 0x30], edi
mov dword [esp + 0x28], ebx
call ebp
mov eax, dword [esi + 0x1e24]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [0x5db724]
push 1
lea edx, [esp + 0x28]
push edx
add eax, 5
push eax
push ecx
mov dword [esp + 0x2c], ebx
call ebp
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00504076
add esp, 0x1c
ret
lea edx, [esp + 0x14]
push edx
push 6
lea eax, [esi + 0x201a]
mov ecx, dword [esi + 0x1e24]
mov edx, dword [0x5db724]
push eax
push ecx
push edx
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00504076
add esp, 0x1c
ret