Function at 0x10018640
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10059898]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0xc]
push edi
push eax
push 0x40
push 5
push 0x45db41
call esi
mov byte [0x45db41], 0xe9
mov eax, 0x1001d430
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
add eax, 0xffba24ba
mov dword [0x45db42], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x45db41
call esi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 2
push 0x456684
call esi
mov eax, 0x456684
mov ebx, 0x90909090
mov word [eax], bx
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 2
push 0x456684
call esi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 2
push 0x45d221
call esi
mov eax, 0x45d221
mov word [eax], bx
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 2
push 0x45d221
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 0x24]
push 0
push 0xd
push eax
push 0x67be90
mov dword [ebp - 0x24], 0x65746e69
mov dword [ebp - 0x20], 0x63616672
mov dword [ebp - 0x1c], 0x7372642e
mov byte [ebp - 0x18], 0
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call ebx
cmp byte [ebp + 8], 0
je 0x10018923
push 0
push 1
lea eax, [ebp - 0x28]
mov byte [ebp - 0x28], 0xa
push eax
push 0x5bb857
call edi
push eax
call ebx
push 0
push 1
lea eax, [ebp - 0x28]
mov byte [ebp - 0x28], 0xa
push eax
push 0x4ea8ae
call edi
push eax
call ebx
push 0
push 5
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x9090006a
push eax
push 0x4df85e
mov byte [ebp - 0x10], 0x90
call edi
push eax
call ebx
lea eax, [ebp - 0x34]
push eax
push 0x40
push 5
push 0x4e2927
call esi
mov byte [0x4e2927], 0xe9
mov eax, 0x10018c00
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
add eax, 0xffb1d6d4
mov dword [0x4e2928], eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x34]
push 5
push 0x4e2927
call esi
push 0
push 1
lea eax, [ebp - 0x28]
mov byte [ebp - 0x28], 0x6e
push eax
push 0x44c5b1
call edi
push eax
call ebx
push 0
push 1
lea eax, [ebp - 0x28]
mov byte [ebp - 0x28], 0x4b
push eax
push 0x44c5e0
call edi
push eax
call ebx
push 0
push 1
lea eax, [ebp - 0x28]
mov byte [ebp - 0x28], 0x66
push eax
push 0x44d4ee
call edi
push eax
call ebx
lea eax, [ebp - 0x34]
push eax
push 0x40
push 1
push 0x44d4ef
call esi
mov eax, 0x44d4ef
mov byte [eax], 0x90
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x34]
push 1
push 0x44d4ef
call esi
lea eax, [ebp - 0x34]
push eax
push 0x40
push 5
push 0x44ca9a
call esi
mov byte [0x44ca9a], 0xe9
mov eax, 0x100163f0
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
add eax, 0xffbb3561
mov dword [0x44ca9b], eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x34]
push 5
push 0x44ca9a
call esi
lea eax, [ebp - 0x34]
push eax
push 0x40
push 5
push 0x44d46f
call esi
mov byte [0x44d46f], 0xe9
mov eax, 0x1001e300
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
add eax, 0xffbb2b8c
mov dword [0x44d470], eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x34]
push 5
push 0x44d46f
call esi
push 0
push 5
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x4ea88868
push eax
push 0x4ea871
mov byte [ebp - 8], 0
call edi
push eax
call ebx
lea eax, [ebp - 0x34]
push eax
push 0x40
push 5
push 0x4ea876
call esi
mov byte [0x4ea876], 0xe9
mov eax, 0x1001cfc0
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
add eax, 0xffb15785
mov dword [0x4ea877], eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x34]
push 5
push 0x4ea876
call esi
lea eax, [ebp - 0x34]
push eax
push 0x40
push 5
push 0x4ed72b
call esi
mov byte [0x4ed72b], 0xe9
mov eax, 0x10016a30
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
add eax, 0xffb128d0
mov dword [0x4ed72c], eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x34]
push 5
push 0x4ed72b
call esi
jmp 0x10018ba5
cmp dword [0x100dc29c], 0
lea eax, [ebp - 0x34]
push eax
push 0x40
push 5
push 0x4e2927
jne 0x1001894c
call esi
mov byte [0x4e2927], 0xe9
mov eax, 0x100199d0
mov dword [ebp - 0x2c], eax
jmp 0x1001895d
call esi
mov byte [0x4e2927], 0xe9
mov eax, 0x1001a740
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
add eax, 0xffb1d6d4
mov dword [0x4e2928], eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x34]
push 5
push 0x4e2927
call esi
push 0
push 1
lea eax, [ebp - 0x28]
mov byte [ebp - 0x28], 0x6e
push eax
push 0x44c5b1
call edi
push eax
call ebx
push 0
push 1
lea eax, [ebp - 0x28]
mov byte [ebp - 0x28], 0x4b
push eax
push 0x44c5e0
call edi
push eax
call ebx
push 0
push 1
lea eax, [ebp - 0x28]
mov byte [ebp - 0x28], 0x66
push eax
push 0x44d4ee
call edi
push eax
call ebx
lea eax, [ebp - 0x34]
push eax
push 0x40
push 1
push 0x44d4ef
call esi
mov eax, 0x44d4ef
mov byte [eax], 0x90
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x34]
push 1
push 0x44d4ef
call esi
lea eax, [ebp - 0x34]
push eax
push 0x40
push 5
push 0x44ca9a
call esi
mov byte [0x44ca9a], 0xe9
mov eax, 0x100163f0
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
add eax, 0xffbb3561
mov dword [0x44ca9b], eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x34]
push 5
push 0x44ca9a
call esi
lea eax, [ebp - 0x34]
push eax
push 0x40
push 5
push 0x44d46f
call esi
mov byte [0x44d46f], 0xe9
mov eax, 0x1001e300
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
add eax, 0xffbb2b8c
mov dword [0x44d470], eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x34]
push 5
push 0x44d46f
call esi
push 0
push 5
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x4ea88868
push eax
push 0x4ea871
mov byte [ebp - 8], 0
call edi
push eax
call ebx
lea eax, [ebp - 0x34]
push eax
push 0x40
push 5
push 0x4ea876
call esi
mov byte [0x4ea876], 0xe9
mov eax, 0x1001ce60
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
add eax, 0xffb15785
mov dword [0x4ea877], eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x34]
push 5
push 0x4ea876
call esi
lea eax, [ebp - 0x34]
push eax
push 0x40
push 5
push 0x4ed72b
call esi
mov byte [0x4ed72b], 0xe9
mov eax, 0x10016450
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
add eax, 0xffb128d0
mov dword [0x4ed72c], eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x34]
push 5
push 0x4ed72b
call esi
lea eax, [ebp - 0x34]
push eax
push 0x40
push 9
push 0x4e80df
call esi
mov eax, 0x4e80df
mov dword [eax], 0x90909090
mov dword [eax + 4], 0x90909090
mov byte [eax + 8], 0x90
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x34]
push 9
push 0x4e80df
call esi
push 0
push 1
lea eax, [ebp - 0x28]
mov byte [ebp - 0x28], 0xeb
push eax
push 0x4e80e8
call edi
push eax
call ebx
push 0
push 1
lea eax, [ebp - 0x28]
mov byte [ebp - 0x28], 0x74
push eax
push 0x4e80e9
call edi
push eax
call ebx
lea eax, [ebp - 0x34]
push eax
push 0x40
push 2
push 0x4e80eb
call esi
mov eax, 0x4e80eb
mov ecx, 0x90909090
mov word [eax], cx
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x34]
push 2
push 0x4e80eb
call esi
push 0
push 1
lea eax, [ebp - 0x28]
mov byte [ebp - 0x28], 0xeb
push eax
push 0x4e8116
call edi
push eax
call ebx
push 0
push 1
lea eax, [ebp - 0x28]
mov byte [ebp - 0x28], 0x46
push eax
push 0x4e8117
call edi
push eax
call ebx
lea eax, [ebp - 0x34]
push eax
push 0x40
push 5
push 0x41cbe6
call esi
mov byte [0x41cbe6], 0xe9
mov eax, 0x1001f6d0
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
add eax, 0xffbe3415
mov dword [0x41cbe7], eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x34]
push 5
push 0x41cbe6
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002f2fb
mov esp, ebp
pop ebp
ret