Function at 0x1003d230
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1004d040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov bl, byte [0x1005b8ed]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
cmp bl, byte [0x1005b910]
je 0x1003d2bc
mov eax, 0x100492e4
mov dword [0x1005b904], 0x100492d8
test bl, bl
mov edx, 0x100492f0
push str.xxxxxxxxx
cmove edx, eax
mov dword [0x1005b914], edx
call fcn.1003d150
mov edi, eax
add esp, 4
mov dword [0x1005b908], edi
test edi, edi
je 0x1003d2bc
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push edi
call esi
test bl, bl
mov dword [edi], 0xa00000be
setne al
add al, 0x42
mov byte [edi + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push edi
call esi
mov byte [0x1005b910], bl
mov bl, byte [0x1005b8ef]
cmp bl, byte [0x1005b911]
je 0x1003d33e
mov eax, 0x10049308
mov dword [0x1005b904], 0x100492fc
test bl, bl
mov edx, 0x10049314
push str.xxxxxxxx
cmove edx, eax
mov dword [0x1005b914], edx
call fcn.1003d150
mov edi, eax
add esp, 4
mov dword [0x1005b908], edi
test edi, edi
je 0x1003d33e
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
test bl, bl
mov word [edi], 0
mov ecx, 0xff
mov eax, 0x2f
cmovne eax, ecx
mov byte [edi + 2], al
setne al
add al, 0x44
mov byte [edi + 3], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push edi
call esi
mov byte [0x1005b911], bl
mov bl, byte [0x1005b8fb]
cmp bl, byte [0x1005b8ee]
je 0x1003d3b2
push str._x__xxxxx_xx______xxxx
mov edx, 0x10049338
mov dword [0x1005b914], 0x10049338
mov dword [0x1005b904], 0x10049320
call fcn.1003d150
mov edi, eax
add esp, 4
mov dword [0x1005b908], edi
test edi, edi
je 0x1003d3b2
lea eax, [ebp - 8]
push eax
push 0x40
push 3
push edi
call esi
test bl, bl
mov word [edi], 0x888a
mov ecx, 0x81
mov eax, 0x84
cmovne eax, ecx
mov byte [edi + 2], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 3
push edi
call esi
mov byte [0x1005b8ee], bl
mov bl, byte [0x1005b8fd]
cmp bl, byte [0x1005b8f8]
je 0x1003d433
mov eax, 0x10049358
mov dword [0x1005b904], 0x10049360
test bl, bl
mov edx, 0x10049350
push str.xxxxxxx
cmove edx, eax
mov dword [0x1005b914], edx
call fcn.1003d150
mov edi, eax
add esp, 4
mov dword [0x1005b908], edi
test edi, edi
je 0x1003d433
lea eax, [ebp - 8]
push eax
push 0x40
push 7
push edi
call esi
test bl, bl
mov dword [edi + 1], 0x24548b25
mov ecx, 0xeb
mov word [edi + 5], 0x5234
mov eax, 0x74
cmovne eax, ecx
mov byte [edi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 7
push edi
call esi
mov byte [0x1005b8f8], bl
mov bl, byte [0x1005b8fa]
cmp bl, byte [0x1005b8fc]
je 0x1003d4b6
mov eax, 0x10049374
mov dword [0x1005b904], 0x100492d8
test bl, bl
mov edx, 0x10049368
push str.xxxxxxxxx
cmove edx, eax
mov dword [0x1005b914], edx
call fcn.1003d150
mov edi, eax
add esp, 4
mov dword [0x1005b908], edi
test edi, edi
je 0x1003d4b6
lea eax, [ebp - 8]
push eax
push 0x40
push 9
push edi
call esi
test bl, bl
mov word [edi], 0
mov byte [edi + 2], 0xf0
setne al
mov dword [edi + 4], 0x40000000
dec al
mov byte [edi + 8], 7
and al, 0x41
mov byte [edi + 3], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 9
push edi
call esi
mov byte [0x1005b8fc], bl
mov bl, byte [0x1005b8ec]
cmp bl, byte [0x1005b8f9]
je 0x1003d525
push str.xxxxxx
mov edx, 0x10049380
mov dword [0x1005b914], 0x10049380
mov dword [0x1005b904], 0x10049388
call fcn.1003d150
mov edi, eax
add esp, 4
mov dword [0x1005b908], edi
test edi, edi
je 0x1003d525
lea eax, [ebp - 8]
push eax
push 0x40
push 6
push edi
call esi
mov dword [edi], 0xce835102
mov byte [edi + 4], 0
mov al, byte [0x10049385]
mov byte [edi + 5], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push edi
call esi
mov byte [0x1005b8f9], bl
mov bl, byte [0x1005b8d5]
cmp bl, byte [0x1005b8ff]
je 0x1003d5a0
mov eax, 0x10049398
mov dword [0x1005b904], 0x100493a0
test bl, bl
mov edx, 0x10049390
push str.xxxxx
cmove edx, eax
mov dword [0x1005b914], edx
call fcn.1003d150
mov edi, eax
add esp, 4
mov dword [0x1005b908], edi
test edi, edi
je 0x1003d5a0
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push edi
call esi
test bl, bl
mov dword [edi + 1], 0x2047d909
mov ecx, 0xeb
mov eax, 0x75
cmovne eax, ecx
mov byte [edi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push edi
call esi
mov byte [0x1005b8ff], bl
mov al, byte [0x1005b8d6]
mov byte [ebp - 9], al
cmp al, byte [0x1005b8d7]
je 0x1003d620
test al, al
mov dword [0x1005b904], 0x100493c0
mov edx, 0x100493a8
mov ebx, 0x100493b4
cmove edx, ebx
push str.xxxxcxxxxxx
mov dword [0x1005b914], edx
call fcn.1003d150
mov edi, eax
add esp, 4
mov dword [0x1005b908], edi
test edi, edi
je 0x1003d620
lea eax, [ebp - 8]
push eax
push 0x40
push 0xb
push edi
call esi
xor ecx, ecx
mov eax, 0x100493a8
cmp byte [ebp - 9], cl
cmove ebx, eax
mov al, byte [ebx + ecx]
mov byte [ecx + edi], al
inc ecx
cmp ecx, 0xb
jl 0x1003d600
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0xb
push edi
call esi
mov al, byte [ebp - 9]
mov byte [0x1005b8d7], al
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10040c7b
mov esp, ebp
pop ebp
ret