Function at 0x1003cac0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1004b040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov bl, byte [0x100598f0]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
cmp bl, byte [0x1005990b]
je 0x1003cb3c
push str.xxxxxxxx
mov edx, 0x10047d54
mov dword [0x10059910], 0x10047d54
mov dword [0x10059900], 0x10047d48
call fcn.1003c9e0
mov edi, eax
add esp, 4
mov dword [0x10059904], edi
test edi, edi
je 0x1003cb3c
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 8]
mov dword [edi], 0x442f0000
push eax
push dword [ebp - 8]
push 4
push edi
call esi
mov byte [0x1005990b], bl
mov bl, byte [0x100598f8]
cmp bl, byte [0x100598ef]
je 0x1003cbb7
mov eax, 0x10047d6c
mov dword [0x10059900], 0x10047d60
test bl, bl
mov edx, 0x10047d78
push str.xxxxxxxxx
cmove edx, eax
mov dword [0x10059910], edx
call fcn.1003c9e0
mov edi, eax
add esp, 4
mov dword [0x10059904], edi
test edi, edi
je 0x1003cbb7
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
test bl, bl
mov word [edi], 0x448b
mov byte [edi + 2], 0x24
setne al
lea eax, [eax*4 + 4]
mov byte [edi + 3], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push edi
call esi
mov byte [0x100598ef], bl
mov bl, byte [0x100598fa]
cmp bl, byte [0x100598f1]
je 0x1003cc38
mov eax, 0x10047d8c
mov dword [0x10059900], 0x10047d94
test bl, bl
mov edx, 0x10047d84
push str.xxxxxxx
cmove edx, eax
mov dword [0x10059910], edx
call fcn.1003c9e0
mov edi, eax
add esp, 4
mov dword [0x10059904], edi
test edi, edi
je 0x1003cc38
lea eax, [ebp - 8]
push eax
push 0x40
push 7
push edi
call esi
test bl, bl
mov dword [edi + 1], 0x244c8b23
mov ecx, 0xeb
mov word [edi + 5], 0x5134
mov eax, 0x74
cmovne eax, ecx
mov byte [edi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 7
push edi
call esi
mov byte [0x100598f1], bl
mov bl, byte [0x100598f3]
cmp bl, byte [0x100598f9]
je 0x1003ccb9
mov eax, 0x10047da4
mov dword [0x10059900], 0x10047d94
test bl, bl
mov edx, str.tZUUUUh
push str.xxxxxxx
cmove edx, eax
mov dword [0x10059910], edx
call fcn.1003c9e0
mov edi, eax
add esp, 4
mov dword [0x10059904], edi
test edi, edi
je 0x1003ccb9
lea eax, [ebp - 8]
push eax
push 0x40
push 7
push edi
call esi
test bl, bl
mov dword [edi + 1], 0x5555555a
mov ecx, 0xeb
mov word [edi + 5], 0x6855
mov eax, 0x74
cmovne eax, ecx
mov byte [edi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 7
push edi
call esi
mov byte [0x100598f9], bl
mov bl, byte [0x100598ee]
cmp bl, byte [0x1005990a]
je 0x1003cd31
mov eax, 0x10047db4
mov dword [0x10059900], 0x10047dac
test bl, bl
mov edx, 0x10047dbc
push str.xx_x__x
cmove edx, eax
mov dword [0x10059910], edx
call fcn.1003c9e0
mov edi, eax
add esp, 4
mov dword [0x10059904], edi
test edi, edi
je 0x1003cd31
lea eax, [ebp - 8]
push eax
push 0x40
push 2
push edi
call esi
test bl, bl
mov byte [edi + 1], 0x17
mov ecx, 0xeb
mov eax, 0x7a
cmovne eax, ecx
mov byte [edi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 2
push edi
call esi
mov byte [0x1005990a], bl
mov bl, byte [0x100598ec]
cmp bl, byte [0x100598f2]
je 0x1003cdad
mov eax, 0x10047dcc
mov dword [0x10059900], 0x10047dd4
test bl, bl
mov edx, 0x10047dc4
push str.xxxxxx
cmove edx, eax
mov dword [0x10059910], edx
call fcn.1003c9e0
mov edi, eax
add esp, 4
mov dword [0x10059904], edi
test edi, edi
je 0x1003cdad
lea eax, [ebp - 8]
push eax
push 0x40
push 6
push edi
call esi
test bl, bl
mov word [edi], 0x6a56
mov word [edi + 3], 0x8352
sete al
mov byte [edi + 5], 0xce
inc al
mov byte [edi + 2], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push edi
call esi
mov byte [0x100598f2], bl
mov bl, byte [0x100598d5]
cmp bl, byte [0x10059908]
je 0x1003ce28
mov eax, 0x10047de4
mov dword [0x10059900], 0x10047dec
test bl, bl
mov edx, 0x10047ddc
push str.xxxxx
cmove edx, eax
mov dword [0x10059910], edx
call fcn.1003c9e0
mov edi, eax
add esp, 4
mov dword [0x10059904], edi
test edi, edi
je 0x1003ce28
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push edi
call esi
test bl, bl
mov dword [edi + 1], 0x204e8b09
mov ecx, 0xeb
mov eax, 0x75
cmovne eax, ecx
mov byte [edi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push edi
call esi
mov byte [0x10059908], bl
mov bl, byte [0x100598ed]
cmp bl, byte [0x10059909]
je 0x1003ce9b
mov eax, 0x10047df4
mov dword [0x10059900], 0x10047d60
test bl, bl
mov edx, 0x10047e00
push str.xxxxxxxxx
cmove edx, eax
mov dword [0x10059910], edx
call fcn.1003c9e0
mov edi, eax
add esp, 4
mov dword [0x10059904], edi
test edi, edi
je 0x1003ce9b
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push edi
call esi
test bl, bl
mov dword [edi], 0xa00000be
setne al
add al, 0x42
mov byte [edi + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push edi
call esi
mov byte [0x10059909], bl
mov bl, byte [0x100598d6]
cmp bl, byte [0x100598d7]
je 0x1003cf15
mov eax, 0x10047e1c
mov dword [0x10059900], 0x10047e0c
test bl, bl
mov edx, 0x10047e30
push str.xxxxxxxxxxxxxxx
cmove edx, eax
mov dword [0x10059910], edx
call fcn.1003c9e0
mov edi, eax
add esp, 4
mov dword [0x10059904], edi
test edi, edi
je 0x1003cf15
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push edi
call esi
test bl, bl
mov word [edi], 0
mov word [edi + 3], 0xc740
setne al
dec al
and al, 0xa0
mov byte [edi + 2], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push edi
call esi
mov byte [0x100598d7], bl
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100400ab
mov esp, ebp
pop ebp
ret