Function at 0x1000b4c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10077abd
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x30
mov eax, dword [0x100a900c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov al, byte [0x100b0308]
mov byte [0x100b0309], al
test al, al
je 0x1000bc82
mov ecx, dword [0x100b003c]
mov edi, 0x25ff
mov edx, dword [0x100cab48]
add edx, 0x37d71
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [0x100b9a40], ecx
lea eax, [ecx + 0x11]
mov dword [0x100b003c], eax
lea eax, [edx + 8]
mov dword [0x100b9a7c], eax
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, 0x68
mov word [ecx + 6], ax
lea eax, [ecx + 7]
mov dword [eax], 0
mov dword [0x100b9ac4], eax
lea eax, [ebp - 0x18]
push eax
push 0x40
push 6
mov word [ecx + 0xb], di
mov dword [ecx + 0xd], 0x100b9a7c
push edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], 6
call esi
mov eax, dword [ebp - 0x20]
mov word [eax], di
mov eax, dword [ebp - 0x20]
mov dword [eax + 2], 0x100b9a40
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call esi
mov eax, dword [0x100cab48]
lea ecx, [ebp - 0x18]
push ecx
push 0x40
add eax, 0xa3e08
mov dword [ebp - 0x1c], 0xc
push 0xc
push eax
mov dword [ebp - 0x20], eax
call esi
cmp byte [0x100b0314], 0
je 0x1000b5e3
mov ecx, dword [0x100b0310]
lea eax, [ecx - 6]
cmp eax, 0x36
ja 0x1000b5e3
mov eax, dword [ebp - 0x20]
mov dword [eax], ecx
mov edx, dword [ebp - 0x20]
jmp 0x1000b5fa
mov edx, dword [ebp - 0x20]
mov byte [ebp - 0x38], 1
mov eax, dword [ebp - 0x38]
mov ecx, dword [edx]
mov dword [0x100b0310], ecx
mov dword [0x100b0314], eax
cmp byte [0x100b031c], 0
je 0x1000b619
mov ecx, dword [0x100b0318]
lea eax, [ecx - 6]
cmp eax, 0x36
ja 0x1000b619
mov dword [edx + 4], ecx
mov edx, dword [ebp - 0x20]
jmp 0x1000b62e
mov ecx, dword [edx + 4]
mov byte [ebp - 0x38], 1
mov eax, dword [ebp - 0x38]
mov dword [0x100b0318], ecx
mov dword [0x100b031c], eax
cmp byte [0x100b0324], 0
je 0x1000b64d
mov ecx, dword [0x100b0320]
lea eax, [ecx - 6]
cmp eax, 0x36
ja 0x1000b64d
mov dword [edx + 8], ecx
mov edx, dword [ebp - 0x20]
jmp 0x1000b662
mov ecx, dword [edx + 8]
mov byte [ebp - 0x38], 1
mov eax, dword [ebp - 0x38]
mov dword [0x100b0320], ecx
mov dword [0x100b0324], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push edx
call esi
mov ecx, dword [0x100cab48]
push 0x100b0330
lea eax, [ecx + 0x37ea2]
push eax
lea eax, [ecx + 0x37e96]
push eax
call fcn.1000bcb0
mov ecx, dword [0x100cab48]
push 0x100b0328
lea eax, [ecx + 0x37e09]
push eax
lea eax, [ecx + 0x37dfd]
push eax
call fcn.1000bcb0
mov eax, dword [0x100cab48]
lea ecx, [ebp - 0x18]
push ecx
push 0x40
add eax, 0x37d81
mov dword [ebp - 0x1c], 4
push 4
push eax
mov dword [ebp - 0x20], eax
call esi
cmp byte [0x100b033b], 0
je 0x1000b6fa
mov ecx, dword [0x100b0338]
mov eax, dword [0x100b9ac4]
bswap ecx
shr ecx, 8
mov dword [eax], ecx
mov ecx, dword [0x100b033c]
mov eax, dword [ebp - 0x20]
bswap ecx
shr ecx, 8
mov dword [eax], ecx
mov edx, dword [ebp - 0x20]
jmp 0x1000b727
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x31], 1
mov eax, dword [edx]
shl eax, 8
bswap eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov byte [ebp - 0x35], 1
mov ecx, dword [ebp - 0x38]
mov dword [0x100b0338], eax
mov dword [0x100b033c], ecx
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push edx
call esi
mov eax, dword [0x100cab48]
lea ecx, [ebp - 0x18]
push ecx
push 0x40
add eax, 0x9a570
mov dword [ebp - 0x1c], 8
push 8
push eax
mov dword [ebp - 0x20], eax
call esi
cmp byte [0x100b0348], 0
mov eax, dword [ebp - 0x20]
je 0x1000b775
mov ecx, dword [0x100b0340]
mov edx, dword [0x100b0344]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x20]
jmp 0x1000b78d
movsd xmm0, qword [eax]
movsd qword [ebp - 0x30], xmm0
mov byte [ebp - 0x28], 1
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [0x100b0340], xmm0
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push eax
call esi
mov eax, dword [0x100cab48]
push 0x100b0380
add eax, 0xa4170
push eax
call fcn.1000bda0
mov eax, dword [0x100cab48]
push 0x100b0350
add eax, 0xa40e0
push eax
call fcn.1000bda0
mov eax, dword [0x100cab48]
push 0x100b035c
add eax, 0xa4104
push eax
call fcn.1000bda0
mov eax, dword [0x100cab48]
push 0x100b0368
add eax, 0xa4128
push eax
call fcn.1000bda0
mov eax, dword [0x100cab48]
push 0x100b0374
add eax, 0xa414c
push eax
call fcn.1000bda0
mov eax, dword [0x100cab48]
push 0x100b038c
add eax, 0xa41b8
push eax
call fcn.1000bda0
mov eax, dword [0x100cab48]
lea ecx, [ebp - 0x18]
push ecx
push 0x40
add eax, 0x375d7
mov dword [ebp - 0x1c], 5
push 5
push eax
mov dword [ebp - 0x20], eax
call esi
cmp byte [0x100b039b], 0
mov ecx, dword [ebp - 0x20]
je 0x1000b867
mov al, byte [0x100b0398]
mov byte [ecx], al
mov eax, dword [ebp - 0x20]
mov cl, byte [0x100b0399]
mov byte [eax + 2], cl
mov eax, dword [ebp - 0x20]
mov cl, byte [0x100b039a]
mov byte [eax + 4], cl
mov ecx, dword [ebp - 0x20]
jmp 0x1000b887
movzx eax, byte [ecx]
mov byte [ebp - 0x34], al
movzx eax, byte [ecx + 2]
mov byte [ebp - 0x33], al
movzx eax, byte [ecx + 4]
mov byte [ebp - 0x32], al
mov byte [ebp - 0x31], 1
mov eax, dword [ebp - 0x34]
mov dword [0x100b0398], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push ecx
call esi
mov eax, dword [0x100cab48]
lea ecx, [ebp - 0x18]
push ecx
push 0x40
add eax, 0x375e2
mov dword [ebp - 0x1c], 1
push 1
push eax
mov dword [ebp - 0x20], eax
call esi
cmp byte [0x100b03a0], 0
mov ecx, dword [ebp - 0x20]
je 0x1000b8cb
mov al, byte [0x100b039c]
mov byte [ecx], al
mov ecx, dword [ebp - 0x20]
jmp 0x1000b8da
movsx eax, byte [ecx]
mov dword [0x100b039c], eax
mov byte [0x100b03a0], 1
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push ecx
call esi
mov eax, dword [0x100cab48]
lea ecx, [ebp - 0x18]
push ecx
push 0x40
add eax, 0xa3e14
mov dword [ebp - 0x1c], 0xc
push 0xc
push eax
mov dword [ebp - 0x20], eax
call esi
mov dword [ebp - 4], 0
cmp byte [0x100b03b4], 0
mov ecx, dword [ebp - 0x20]
je 0x1000b955
mov eax, dword [0x100b03a8]
mov dword [ecx], eax
cmp byte [0x100b03b4], 0
je 0x1000bca0
mov ecx, dword [ebp - 0x20]
mov eax, dword [0x100b03ac]
mov dword [ecx + 4], eax
cmp byte [0x100b03b4], 0
je 0x1000bca0
mov ecx, dword [ebp - 0x20]
mov eax, dword [0x100b03b0]
mov dword [ecx + 8], eax
mov ecx, dword [ebp - 0x20]
jmp 0x1000b988
mov dword [0x100b03b0], 0
xorps xmm0, xmm0
movq qword [0x100b03a8], xmm0
mov byte [0x100b03b4], 1
mov eax, dword [ecx]
mov dword [0x100b03a8], eax
mov eax, dword [ecx + 4]
mov dword [0x100b03ac], eax
mov eax, dword [ecx + 8]
mov dword [0x100b03b0], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push ecx
call esi
mov eax, dword [0x100cab48]
lea ecx, [ebp - 0x18]
push ecx
push 0x40
add eax, 0xa4040
mov dword [ebp - 0x1c], 8
push 8
push eax
mov dword [ebp - 0x20], eax
call esi
cmp byte [0x100b03bb], 0
je 0x1000b9e5
mov eax, dword [ebp - 0x20]
mov ecx, dword [0x100b03b8]
and ecx, 0xffffff
mov dword [eax], ecx
mov ecx, dword [0x100b03bc]
mov eax, dword [ebp - 0x20]
and ecx, 0xffffff
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x20]
jmp 0x1000ba0b
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x35], 1
mov eax, dword [ebp - 0x38]
mov dword [0x100b03b8], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x35], 1
mov eax, dword [ebp - 0x38]
mov dword [0x100b03bc], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push ecx
call esi
mov ecx, dword [0x100b03a4]
mov eax, ecx
bswap eax
shr eax, 8
cmp eax, 0xffffff
je 0x1000ba78
bswap ecx
shr ecx, 8
push ecx
push 0
push 2
call dword [sym.imp.GDI32.dll_CreatePen]
lea ecx, [ebp - 0x24]
mov dword [0x100b9ab0], eax
mov eax, dword [0x100cab48]
push ecx
push 0x40
add eax, 0x375fb
mov dword [ebp - 0x28], 4
push 4
push eax
mov dword [ebp - 0x2c], eax
call esi
mov eax, dword [ebp - 0x2c]
mov dword [eax], 0x100b9ab0
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call esi
mov eax, dword [0x100cab48]
lea ecx, [ebp - 0x24]
push ecx
push 0x40
add eax, 0xa404c
mov dword [ebp - 0x28], 4
push 4
push eax
mov dword [ebp - 0x2c], eax
call esi
mov eax, dword [0x100cab48]
lea ecx, [ebp - 0x18]
push ecx
push 0x40
add eax, 0xa4048
mov dword [ebp - 0x1c], 4
push 4
push eax
mov dword [ebp - 0x20], eax
call esi
cmp byte [0x100b03c3], 0
mov eax, dword [ebp - 0x2c]
je 0x1000bae4
mov ecx, dword [0x100b03c0]
bswap ecx
shr ecx, 8
mov dword [eax], ecx
mov ecx, dword [0x100b03c4]
mov eax, dword [ebp - 0x20]
bswap ecx
shr ecx, 8
mov dword [eax], ecx
mov edx, dword [ebp - 0x20]
jmp 0x1000bb14
mov eax, dword [eax]
mov edx, dword [ebp - 0x20]
shl eax, 8
bswap eax
mov dword [ebp - 0x38], eax
mov eax, dword [edx]
shl eax, 8
bswap eax
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x35], 1
mov eax, dword [ebp - 0x38]
mov byte [ebp - 0x31], 1
mov ecx, dword [ebp - 0x34]
mov dword [0x100b03c0], eax
mov dword [0x100b03c4], ecx
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push edx
call esi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call esi
mov eax, dword [0x100cab48]
lea ecx, [ebp - 0x18]
push ecx
push 0x40
add eax, 0xa4054
mov dword [ebp - 0x1c], 4
push 4
push eax
mov dword [ebp - 0x20], eax
call esi
mov eax, dword [0x100cab48]
lea ecx, [ebp - 0x24]
push ecx
push 0x40
add eax, 0xa4050
mov dword [ebp - 0x28], 4
push 4
push eax
mov dword [ebp - 0x2c], eax
call esi
cmp byte [0x100b03cb], 0
je 0x1000bb9e
mov eax, dword [ebp - 0x20]
mov ecx, dword [0x100b03c8]
and ecx, 0xffffff
mov dword [eax], ecx
mov ecx, dword [0x100b03cc]
mov eax, dword [ebp - 0x2c]
and ecx, 0xffffff
mov dword [eax], ecx
mov edx, dword [ebp - 0x2c]
jmp 0x1000bbc7
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x20]
mov byte [ebp - 0x31], 1
mov ecx, dword [ebp - 0x34]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x35], 1
mov eax, dword [ebp - 0x38]
mov dword [0x100b03c8], eax
mov dword [0x100b03cc], ecx
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push edx
call esi
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call esi
cmp dword [0x100b0014], 1
mov edi, 0xe890
jle 0x1000bc35
mov eax, dword [0x100cab48]
lea ecx, [ebp - 0x24]
push ecx
push 0x40
add eax, 0x38dec
mov dword [ebp - 0x28], 6
push 6
push eax
mov dword [ebp - 0x2c], eax
call esi
mov eax, dword [ebp - 0x2c]
mov ecx, 0x10073090
mov word [eax], di
mov eax, dword [ebp - 0x2c]
sub ecx, eax
sub ecx, 6
mov dword [eax + 2], ecx
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call esi
cmp dword [0x100b0034], 1
jle 0x1000bc82
mov eax, dword [0x100cab48]
lea ecx, [ebp - 0x24]
push ecx
push 0x40
add eax, 0x38c63
mov dword [ebp - 0x28], 6
push 6
push eax
mov dword [ebp - 0x2c], eax
call esi
mov eax, dword [ebp - 0x2c]
mov ecx, 0x100730c0
mov word [eax], di
mov eax, dword [ebp - 0x2c]
sub ecx, eax
sub ecx, 6
mov dword [eax + 2], ecx
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1007491a
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.10002020
int3