Function at 0x1000f250
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1012800c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x1000fc30
push 0x40b154
push 0xe9
call fcn.1007d440
push 0x1000f230
push 0x4cf56c
push 0xe8
call fcn.1007d440
push 0x1000f230
push 0x4d04ba
push 0xe8
call fcn.1007d440
push 0x1000f230
push 0x77255e
push 0xe8
call fcn.1007d440
push 0x1000fcb0
push 0x64a79a
push 0xff
call fcn.1007d440
push 0x1000fcb0
push 0x64a85f
push 0xff
call fcn.1007d440
add esp, 0x48
push 0x1000fcb0
push 0x656e03
push 0xff
call fcn.1007d440
push 0x1000fcb0
push 0x64ab3d
push 0xff
call fcn.1007d440
push 0x1000fcb0
push 0x64ac02
push 0xff
call fcn.1007d440
push 0x1000fcb0
push 0x63ddf2
push 0xff
call fcn.1007d440
push 0x1000fcb0
push 0x63df89
push 0xff
call fcn.1007d440
push 0x1000fcb0
push 0x63ea4c
push 0xff
call fcn.1007d440
add esp, 0x48
push 0x1000fcb0
push 0x64ca0c
push 0xff
call fcn.1007d440
push 0x1000fcb0
push 0x77faf9
push 0xff
call fcn.1007d440
push 0x1000fcb0
push 0x81071b
push 0xff
call fcn.1007d440
push 0x1000fcb0
push 0x81079b
push 0xff
call fcn.1007d440
push 0x1000fbb0
push 0x47fe31
push 0xff
call fcn.1007d440
push 0x1000fbb0
push 0x59890d
push 0xff
call fcn.1007d440
add esp, 0x48
push 0x1000fbb0
push 0x59a399
push 0xff
call fcn.1007d440
push 0x1000fbb0
push 0x59a93c
push 0xff
call fcn.1007d440
push 0x1000fbb0
push 0x59b13b
push 0xff
call fcn.1007d440
push 0x1000fbb0
push 0x5a4261
push 0xff
call fcn.1007d440
push 0x1000fbb0
push 0x5a4d52
push 0xff
call fcn.1007d440
push 0x1000fbb0
push 0x5b6117
push 0xff
call fcn.1007d440
add esp, 0x48
push 0x1000fbb0
push 0x65a6ce
push 0xff
call fcn.1007d440
push 0x1000fbb0
push 0x727987
push 0xff
call fcn.1007d440
push 0x1000fbb0
push 0x7861f1
push 0xff
call fcn.1007d440
push 0x1000fbb0
push 0x7d32fa
push 0xff
call fcn.1007d440
push 0x1000fbb0
push 0x7d3b0d
push 0xff
call fcn.1007d440
push 0x1000fce0
push 0x8317bd
push 0xe9
call fcn.1007d440
add esp, 0x48
push 0x1000eeb0
push 0x772459
push 0xe9
call fcn.1007d440
push 0x1000eed0
push 0x614ae8
push 0xe9
call fcn.1007d440
push 0x1000eef0
push 0x55179f
push 0xe8
call fcn.1007d440
push 0x1000eef0
push 0x551911
push 0xe8
call fcn.1007d440
push 0x1000eef0
push 0x55272f
push 0xe8
call fcn.1007d440
push 0x1000eef0
push 0x59c2de
push 0xe8
call fcn.1007d440
add esp, 0x48
push 0x1000eef0
push 0x59d02e
push 0xe8
call fcn.1007d440
push 0x1000eef0
push 0x59e6a9
push 0xe8
call fcn.1007d440
push 0x1000eef0
push 0x5ac570
push 0xe8
call fcn.1007d440
push 0x1000eef0
push 0x5ad840
push 0xe8
call fcn.1007d440
push 0x1000eef0
push 0x5adae8
push 0xe8
call fcn.1007d440
push 0x1000eef0
push 0x5ade42
push 0xe8
call fcn.1007d440
add esp, 0x48
push 0x1000eef0
push 0x5ae1d1
push 0xe8
call fcn.1007d440
push 0x1000eef0
push 0x5ae870
push 0xe8
call fcn.1007d440
push 0x1000eef0
push 0x5aeb93
push 0xe8
call fcn.1007d440
push 0x1000eef0
push 0x5af1cd
push 0xe8
call fcn.1007d440
push 0x1000eef0
push 0x5af522
push 0xe8
call fcn.1007d440
push 0x1000eef0
push 0x5b05e7
push 0xe8
call fcn.1007d440
add esp, 0x48
push 0x1000eef0
push 0x5b073e
push 0xe8
call fcn.1007d440
push 0x1000eef0
push 0x5b0c23
push 0xe8
call fcn.1007d440
push 0x1000eef0
push 0x5b0da8
push 0xe8
call fcn.1007d440
push 0x1000eef0
push 0x5b1898
push 0xe8
call fcn.1007d440
push 0x1000eef0
push 0x5b22b3
push 0xe8
call fcn.1007d440
push 0x1000eef0
push 0x5b2cb4
push 0xe8
call fcn.1007d440
add esp, 0x48
push 0x1000eef0
push 0x5b3870
push 0xe8
call fcn.1007d440
push 0x1000eef0
push 0x616a1a
push 0xe8
call fcn.1007d440
push 0x1000eef0
push 0x63f4a7
push 0xe8
call fcn.1007d440
push 0x1000eef0
push 0x645712
push 0xe8
call fcn.1007d440
push 0x1000eef0
push 0x647503
push 0xe8
call fcn.1007d440
push 0x1000eef0
push 0x647594
push 0xe8
call fcn.1007d440
add esp, 0x48
push 0x1000eef0
push 0x647bdc
push 0xe8
call fcn.1007d440
push 0x1000eef0
push 0x749b83
push 0xe8
call fcn.1007d440
push 0x1000eef0
push 0x749c03
push 0xe8
call fcn.1007d440
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
add esp, 0x24
push eax
push 0x40
push 1
push 0x8553d0
call esi
lea eax, [ebp - 8]
mov byte [0x8553d0], 0xc3
push eax
push dword [ebp - 8]
push 1
push 0x8553d0
call esi
push 0x58811f
push 0x5880f0
push 0xe9
call fcn.1007d440
add esp, 0xc
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x588447
call esi
lea eax, [ebp - 8]
mov dword [0x588447], 0xfff
push eax
push dword [ebp - 8]
push 4
push 0x588447
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x59a8d0
call esi
lea eax, [ebp - 8]
mov byte [0x59a8d0], 0xeb
push eax
push dword [ebp - 8]
push 1
push 0x59a8d0
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x59b001
call esi
lea eax, [ebp - 8]
mov byte [0x59b001], 0xeb
push eax
push dword [ebp - 8]
push 1
push 0x59b001
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x597695
call esi
lea eax, [ebp - 8]
mov byte [0x597695], 0x30
push eax
push dword [ebp - 8]
push 1
push 0x597695
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x4cfa8f
call esi
lea eax, [ebp - 8]
mov byte [0x4cfa8f], 0x5b
push eax
push dword [ebp - 8]
push 1
push 0x4cfa8f
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x4cfa90
call esi
lea eax, [ebp - 8]
mov byte [0x4cfa90], 0x2f
push eax
push dword [ebp - 8]
push 1
push 0x4cfa90
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x60d985
call esi
lea eax, [ebp - 8]
mov byte [0x60d985], 0x5b
push eax
push dword [ebp - 8]
push 1
push 0x60d985
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x60d986
call esi
lea eax, [ebp - 8]
mov byte [0x60d986], 0x2f
push eax
push dword [ebp - 8]
push 1
push 0x60d986
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x60f356
call esi
lea eax, [ebp - 8]
mov byte [0x60f356], 0x5b
push eax
push dword [ebp - 8]
push 1
push 0x60f356
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x60f357
call esi
lea eax, [ebp - 8]
mov byte [0x60f357], 0x2f
push eax
push dword [ebp - 8]
push 1
push 0x60f357
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x6103ee
call esi
lea eax, [ebp - 8]
mov byte [0x6103ee], 0x5b
push eax
push dword [ebp - 8]
push 1
push 0x6103ee
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x6103ef
call esi
lea eax, [ebp - 8]
mov byte [0x6103ef], 0x2f
push eax
push dword [ebp - 8]
push 1
push 0x6103ef
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x969c60
call esi
lea eax, [ebp - 8]
mov byte [0x969c60], 0x5b
push eax
push dword [ebp - 8]
push 1
push 0x969c60
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x969c61
call esi
lea eax, [ebp - 8]
mov byte [0x969c61], 0x2f
push eax
push dword [ebp - 8]
push 1
push 0x969c61
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x969b3f
call esi
lea eax, [ebp - 8]
mov byte [0x969b3f], 0xc4
push eax
push dword [ebp - 8]
push 1
push 0x969b3f
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x969b40
call esi
mov byte [0x969b40], 0x8a
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push 0x969b40
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x969b41
call esi
lea eax, [ebp - 8]
mov byte [0x969b41], 0x37
push eax
push dword [ebp - 8]
push 1
push 0x969b41
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x969b60
call esi
lea eax, [ebp - 8]
mov byte [0x969b60], 0xb0
push eax
push dword [ebp - 8]
push 1
push 0x969b60
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x969b61
call esi
lea eax, [ebp - 8]
mov byte [0x969b61], 0x36
push eax
push dword [ebp - 8]
push 1
push 0x969b61
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x969b6f
call esi
lea eax, [ebp - 8]
mov byte [0x969b6f], 0xb0
push eax
push dword [ebp - 8]
push 1
push 0x969b6f
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x969b70
call esi
lea eax, [ebp - 8]
mov byte [0x969b70], 0x36
push eax
push dword [ebp - 8]
push 1
push 0x969b70
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x969bad
call esi
lea eax, [ebp - 8]
mov byte [0x969bad], 0xc0
push eax
push dword [ebp - 8]
push 1
push 0x969bad
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x969bae
call esi
lea eax, [ebp - 8]
mov byte [0x969bae], 0x8a
push eax
push dword [ebp - 8]
push 1
push 0x969bae
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x969baf
call esi
lea eax, [ebp - 8]
mov byte [0x969baf], 0x37
push eax
push dword [ebp - 8]
push 1
push 0x969baf
call esi
cmp byte [0x1012fbe9], 1
jne 0x1000fb96
lea eax, [ebp - 8]
push eax
push 0x40
push 0xa
push 0x59ca3c
call esi
mov eax, 0x59ca3c
mov ecx, 0x90909090
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov word [eax + 8], cx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0xa
push 0x59ca3c
call esi
push 0x1000f1f0
push 0x59ca3c
push 0xe9
call fcn.1007d440
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1007ff35
mov esp, ebp
pop ebp
ret