Function at 0x10005070
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Execute shellcode via indirect call

Disassembly:
sub esp, 0x14
push ebp
push esi
mov ebp, 5
mov esi, edx
push ecx
mov dword [esp + 0xc], ebp
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x1000526c
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1000526c
push ebx
push 0x40
push 0x1000
push 0x20
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
je 0x10005263
movzx eax, byte [esi]
mov byte [ebx], al
movzx eax, byte [esi + 1]
mov byte [ebx + 1], al
movzx eax, byte [esi + 2]
mov byte [ebx + 2], al
movzx eax, byte [esi + 3]
mov byte [ebx + 3], al
movzx eax, byte [esi + 4]
mov byte [ebx + 4], al
mov al, byte [esi]
push edi
cmp al, 0xe8
je 0x10005154
cmp al, 0xe9
je 0x10005154
cmp al, 0x8d
je 0x10005195
cmp al, 0x6a
jne 0x10005128
mov byte [ebx], al
mov ebp, 7
movzx eax, byte [esi + 1]
mov byte [ebx + 1], al
movzx eax, byte [esi + 2]
mov byte [ebx + 2], al
movzx eax, byte [esi + 3]
mov byte [ebx + 3], al
movzx eax, byte [esi + 4]
mov byte [ebx + 4], al
movzx eax, byte [esi + 5]
mov byte [ebx + 5], al
movzx eax, byte [esi + 6]
mov byte [ebx + 6], al
jmp 0x10005195
cmp al, 0xff
jne 0x10005195
mov al, byte [esi + 1]
cmp al, 0x15
je 0x10005137
cmp al, 0x25
jne 0x10005195
mov ebp, 6
mov edi, esi
mov ecx, ebx
sub edi, ebx
mov edx, ebp
mov al, byte [edi + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edx, 1
jne 0x10005144
jmp 0x10005195
mov edi, ebx
lea eax, [esp + 0x14]
xor edx, edx
sub edi, esi
sub eax, esi
mov ecx, esi
mov ebp, eax
movzx eax, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx + edi - 1], al
inc edx
movzx eax, byte [ecx - 1]
mov byte [ecx + ebp - 1], al
cmp edx, 5
jb 0x10005164
mov ebp, dword [esp + 0x10]
mov eax, esi
sub eax, ebx
add dword [esp + 0x15], eax
mov eax, dword [esp + 0x14]
mov dword [ebx], eax
mov al, byte [esp + 0x18]
mov byte [ebx + 4], al
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edi, [ebx + ebp]
mov dword [esp + 0x10], eax
test edi, edi
je 0x100051ff
mov eax, esi
mov byte [esp + 0x1c], 0xe9
sub eax, edi
mov dword [esp + 0x14], 0
add eax, 0xfffffffb
add eax, ebp
mov dword [esp + 0x1d], eax
lea eax, [esp + 0x14]
push eax
push 0x40
push 5
push edi
call dword [esp + 0x20]
test eax, eax
je 0x100051ff
lea edx, [esp + 0x1c]
xor ecx, ecx
sub edx, edi
nop dword [eax]
lea eax, [edx + ecx]
mov al, byte [eax + edi]
mov byte [edi + ecx], al
inc ecx
cmp ecx, 5
jb 0x100051e0
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
push 5
push edi
call dword [esp + 0x20]
mov eax, 0x1000ad90
mov byte [esp + 0x1c], 0xe9
sub eax, esi
mov dword [esp + 0x14], 0
sub eax, 5
mov dword [esp + 0x1d], eax
lea eax, [esp + 0x14]
push eax
push 0x40
push ebp
push esi
call dword [esp + 0x20]
pop edi
test eax, eax
je 0x1000525a
lea edx, [esp + 0x18]
xor eax, eax
sub edx, esi
cmp eax, 5
jae 0x10005241
lea ecx, [edx + eax]
mov cl, byte [ecx + esi]
jmp 0x10005243
mov cl, 0x90
mov byte [esi + eax], cl
inc eax
cmp eax, ebp
jb 0x10005234
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push ebp
push esi
call dword [esp + 0x1c]
mov eax, ebx
pop ebx
pop esi
pop ebp
add esp, 0x14
ret
pop ebx
pop esi
xor eax, eax
pop ebp
add esp, 0x14
ret
pop esi
xor eax, eax
pop ebp
add esp, 0x14
ret