Function at 0x10029670
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1010800c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x578bf6
call esi
mov eax, 0x578bf6
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push 0x578bf6
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x578c4f
call esi
mov eax, 0x578c4f
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push 0x578c4f
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 0x55
push 0x8553d0
call esi
push 0x55
push 0x90
push 0x8553d0
call fcn.100af490
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0x55
push 0x8553d0
call esi
push 0x5db408
push 0x5db322
push 0xe9
call fcn.1005ef80
add esp, 0xc
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x50f68d
call esi
lea eax, [ebp - 8]
mov byte [0x50f68d], 0
push eax
push dword [ebp - 8]
push 1
push 0x50f68d
call esi
push 0x791050
push 0x7c1ad7
push 0xe8
call fcn.1005ef80
push 0x791050
push 0x7c29fb
push 0xe8
call fcn.1005ef80
push 0x791050
push 0x7c69bd
push 0xe8
call fcn.1005ef80
push 0x791050
push 0x7c78f0
push 0xe8
call fcn.1005ef80
push 0x791050
push 0x7f02d6
push 0xe8
call fcn.1005ef80
push 0x791050
push 0x80d4a6
push 0xe8
call fcn.1005ef80
add esp, 0x48
push 0x791050
push 0x84314a
push 0xe8
call fcn.1005ef80
push 0x791050
push 0x846618
push 0xe8
call fcn.1005ef80
push 0x791050
push 0x84a296
push 0xe8
call fcn.1005ef80
push 0x791050
push 0x84e41c
push 0xe8
call fcn.1005ef80
push 0x791050
push 0x84f1d6
push 0xe8
call fcn.1005ef80
push 0x791050
push 0x850278
push 0xe8
call fcn.1005ef80
add esp, 0x48
push 0x791050
push 0x851d88
push 0xe8
call fcn.1005ef80
push 0x791050
push 0x85471f
push 0xe8
call fcn.1005ef80
push 0x791050
push 0x87a126
push 0xe8
call fcn.1005ef80
push 0x791050
push 0x880777
push 0xe8
call fcn.1005ef80
push 0x791050
push 0x8814e6
push 0xe8
call fcn.1005ef80
push 0x791050
push 0x883196
push 0xe8
call fcn.1005ef80
add esp, 0x48
push 0x791050
push 0x8848b6
push 0xe8
call fcn.1005ef80
push 0x791050
push 0x8880e6
push 0xe8
call fcn.1005ef80
push 0x791050
push 0x893367
push 0xe8
call fcn.1005ef80
push 0x791050
push 0x893f37
push 0xe8
call fcn.1005ef80
push 0x791050
push 0x874ac7
push 0xe8
call fcn.1005ef80
push 0x791050
push 0x7c56ee
push 0xe8
call fcn.1005ef80
add esp, 0x48
push 0x791050
push 0x7f4c2d
push 0xe8
call fcn.1005ef80
push 0x791050
push 0x7ca80f
push 0xe8
call fcn.1005ef80
push 0x791050
push 0x8659c5
push 0xe8
call fcn.1005ef80
push 0x791050
push 0x83e38b
push 0xe8
call fcn.1005ef80
push 0x791050
push 0x7d19a2
push 0xe8
call fcn.1005ef80
push 0x791050
push 0x78e156
push 0xe8
call fcn.1005ef80
add esp, 0x48
push 0x791050
push 0x878527
push 0xe8
call fcn.1005ef80
push 0x791050
push 0x82dfe6
push 0xe8
call fcn.1005ef80
push 0x791050
push 0x847b27
push 0xe8
call fcn.1005ef80
push 0x791050
push 0x8682b7
push 0xe8
call fcn.1005ef80
push 0x791050
push 0x856a9e
push 0xe8
call fcn.1005ef80
push 0x791050
push 0x7d512e
push 0xe8
call fcn.1005ef80
add esp, 0x48
push 0x791050
push 0x858a35
push 0xe8
call fcn.1005ef80
push 0x791050
push 0x77ee2b
push 0xe8
call fcn.1005ef80
push 0x791050
push 0x84198e
push 0xe8
call fcn.1005ef80
push 0x791050
push 0x83b5c6
push 0xe8
call fcn.1005ef80
add esp, 0x30
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x944a46
call esi
mov eax, 0x944a46
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push 0x944a46
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x94495f
call esi
mov eax, 0x94495f
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push 0x94495f
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x9449d2
call esi
mov eax, 0x9449d2
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push 0x9449d2
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x787c7d
call esi
mov eax, 0x787c7d
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push 0x787c7d
call esi
push 0x7867b3
push 0x7867a5
push 0xe9
call fcn.1005ef80
add esp, 0xc
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x57bda2
call esi
lea eax, [ebp - 8]
mov byte [0x57bda2], 0x10
push eax
push dword [ebp - 8]
push 1
push 0x57bda2
call esi
push 0x59b00e
push 0x59affa
push 0xe9
call fcn.1005ef80
push 0x644537
push 0x64452a
push 0xe9
call fcn.1005ef80
add esp, 0x18
lea eax, [ebp - 8]
push eax
push 0x40
push 0x18
push 0x77eecd
call esi
mov eax, 0x77eecd
mov dword [eax], 0x90909090
mov dword [eax + 4], 0x90909090
mov dword [eax + 8], 0x90909090
mov dword [eax + 0xc], 0x90909090
mov dword [eax + 0x10], 0x90909090
mov dword [eax + 0x14], 0x90909090
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0x18
push 0x77eecd
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x7af176
call esi
lea eax, [ebp - 8]
mov byte [0x7af176], 9
push eax
push dword [ebp - 8]
push 1
push 0x7af176
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x7af416
call esi
lea eax, [ebp - 8]
mov byte [0x7af416], 9
push eax
push dword [ebp - 8]
push 1
push 0x7af416
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x7af796
call esi
lea eax, [ebp - 8]
mov byte [0x7af796], 9
push eax
push dword [ebp - 8]
push 1
push 0x7af796
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x7b0316
call esi
lea eax, [ebp - 8]
mov byte [0x7b0316], 9
push eax
push dword [ebp - 8]
push 1
push 0x7b0316
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x7aef56
call esi
lea eax, [ebp - 8]
mov byte [0x7aef56], 7
push eax
push dword [ebp - 8]
push 1
push 0x7aef56
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x59af55
call esi
lea eax, [ebp - 8]
mov byte [0x59af55], 0
push eax
push dword [ebp - 8]
push 1
push 0x59af55
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x59b24a
call esi
lea eax, [ebp - 8]
mov byte [0x59b24a], 0
push eax
push dword [ebp - 8]
push 1
push 0x59b24a
call esi
push 0x100290f0
push 0x835116
push 0xe8
call fcn.1005ef80
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop esi
call fcn.100617e6
mov esp, ebp
pop ebp
ret