Function at 0x1000daf0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x4c
mov eax, dword [0x100b3100]
xor eax, esp
mov dword [esp + 0x48], eax
push esi
push str.win32u.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000db30
push str.NtUserSendInput
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100b6a98], eax
test eax, eax
jne 0x1000db42
push str.____NtUserSendInput_is_null
jmp 0x1000db35
push str.____win32u.dll_is_null
push 0x100b4250
call fcn.10010dc0
add esp, 8
push dword [esp + 0x48]
call fcn.1000e840
add esp, 4
push dword [esp + 0x48]
call fcn.1000e8d0
add esp, 4
push dword [esp + 0x48]
call fcn.1000e960
add esp, 4
mov esi, 0x100b3a20
nop dword [eax + eax]
mov eax, dword [esi + 4]
cmp dword [eax], 0
jne 0x1000db8c
push dword [esi]
push str._____s_wasnt_found
push 0x100b4250
call fcn.10010dc0
add esp, 0xc
add esi, 8
cmp esi, 0x100b3ac8
jne 0x1000db70
mov eax, dword [0x100b69d4]
test eax, eax
je 0x1000dbec
cmp dword [eax], 2
jne 0x1000dbec
mov eax, dword [0x100b6a98]
test eax, eax
je 0x1000dbec
cmp byte [eax], 0xe9
jne 0x1000dbec
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [esp + 0x48]
push ecx
push 0x40
push 5
push eax
call esi
mov ecx, dword [0x100b6a98]
mov eax, dword [ecx + 1]
mov dword [0x100b6a44], eax
mov eax, dword [0x100b3ac8]
mov byte [ecx], 0xb8
mov dword [ecx + 1], eax
lea eax, [esp + 0x48]
push eax
push dword [esp + 0x4c]
push 5
push ecx
call esi
cmp byte [0x100b7da0], 0
jne 0x1000dc1d
cmp byte [0x100b6b9f], 0
jne 0x1000dc1d
cmp byte [0x100b7da1], 0
jne 0x1000dc1d
cmp byte [0x100b7da4], 0
jne 0x1000dc1d
cmp byte [0x100b7da3], 0
jne 0x1000dc1d
xor dl, dl
jmp 0x1000dc1f
mov dl, 1
mov ecx, dword [0x100b6a6c]
mov byte [esp + 0xf], dl
test ecx, ecx
je 0x1000dca4
mov dword [esp + 0x10], ecx
mov esi, 6
mov dword [esp + 0x14], 0x1000e240
xorps xmm1, xmm1
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], esi
mov word [esp + 0x30], pe_nt_image_headers32
mov eax, dword [esp + 0x30]
mov dword [0x100b3fb8], eax
movups xmm0, xmmword [esp + 0x10]
movups xmmword [0x100b3fa8], xmm1
movups xmmword [0x100b3f98], xmm0
test dl, dl
je 0x1000dca4
push esi
push ecx
push 0x100b3fa8
call fcn.100568a0
mov edx, dword [0x100b3f9c]
add esp, 0xc
mov ecx, dword [0x100b3f98]
push dword [0x100b3fa4]
call fcn.10009230
add esp, 4
mov byte [0x100b3fb8], 1
mov eax, dword [0x100b6a94]
test eax, eax
je 0x1000dd03
add eax, 0xf
mov dword [esp + 0x14], 0x1000e260
cmp byte [esp + 0xf], 0
xorps xmm1, xmm1
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x100b6a8c
mov dword [esp + 0x1c], 5
movups xmm0, xmmword [esp + 0x10]
mov word [esp + 0x30], pe_nt_image_headers32
mov eax, dword [esp + 0x30]
movups xmmword [0x100b3fbc], xmm0
mov dword [0x100b3fdc], eax
movups xmmword [0x100b3fcc], xmm1
je 0x1000dd03
mov ecx, 0x100b3fbc
call fcn.10001560
mov eax, dword [0x100b6a74]
test eax, eax
je 0x1000dd73
cmp byte [0x100b3acc], 0
xorps xmm1, xmm1
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0x1000e290
mov dword [esp + 0x18], 0x100b6a88
mov dword [esp + 0x1c], 5
movups xmm0, xmmword [esp + 0x10]
mov word [esp + 0x30], pe_nt_image_headers32
mov eax, dword [esp + 0x30]
movups xmmword [0x100b3fe0], xmm0
mov dword [0x100b4000], eax
movups xmmword [0x100b3ff0], xmm1
jne 0x1000dd69
cmp byte [0x100b3b1c], 0
jne 0x1000dd69
cmp byte [0x100b3af4], 0
je 0x1000dd73
mov ecx, 0x100b3fe0
call fcn.10001560
call fcn.10009290
call fcn.1000ef80
mov eax, dword [0x100b6b74]
test eax, eax
je 0x1000de6f
cmp dword [0x100b6b84], 0
je 0x1000de6f
cmp byte [0x100b7da5], 0
xorps xmm1, xmm1
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0x100103f0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0xa
movups xmm0, xmmword [esp + 0x10]
mov word [esp + 0x30], pe_nt_image_headers32
mov eax, dword [esp + 0x30]
mov dword [0x100b4240], eax
mov eax, dword [0x100b6b7c]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0x10010420
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 6
movups xmmword [0x100b4220], xmm0
mov word [esp + 0x30], pe_nt_image_headers32
movups xmm0, xmmword [esp + 0x10]
mov eax, dword [esp + 0x30]
mov dword [0x100b421c], eax
mov eax, dword [0x100b6b78]
mov dword [esp + 0x10], eax
movups xmmword [0x100b41fc], xmm0
mov dword [esp + 0x14], 0x10010430
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 6
movups xmm0, xmmword [esp + 0x10]
mov word [esp + 0x30], pe_nt_image_headers32
mov eax, dword [esp + 0x30]
movups xmmword [0x100b4230], xmm1
mov dword [0x100b41f8], eax
movups xmmword [0x100b420c], xmm1
movups xmmword [0x100b41d8], xmm0
movups xmmword [0x100b41e8], xmm1
je 0x1000de6f
call fcn.10010240
mov eax, dword [0x100b6b6c]
test eax, eax
je 0x1000dec8
cmp byte [0x100b6b9d], 0
xorps xmm1, xmm1
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0x10010230
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 5
movups xmm0, xmmword [esp + 0x10]
mov word [esp + 0x30], pe_nt_image_headers32
mov eax, dword [esp + 0x30]
movups xmmword [0x100b41b4], xmm0
mov dword [0x100b41d4], eax
movups xmmword [0x100b41c4], xmm1
je 0x1000dec8
call fcn.10010180
call fcn.10004b50
mov dword [0x100b6b30], eax
test eax, eax
je 0x1000dfa2
cmp byte [0x100b67d7], 0
lea ecx, [eax + 5]
mov dword [esp + 0x10], eax
xorps xmm1, xmm1
mov dword [esp + 0x14], 0x1000fca0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 5
movups xmm0, xmmword [esp + 0x10]
mov word [esp + 0x30], pe_nt_image_headers32
mov eax, dword [esp + 0x30]
mov dword [0x100b6b34], ecx
movups xmmword [0x100b4148], xmm0
mov dword [0x100b4168], eax
movups xmmword [0x100b4158], xmm1
je 0x1000dfa2
call fcn.1000fbf0
cmp byte [0x100b6ba0], 0
je 0x1000df58
push 0x100b6b20
push 0x100b6b18
mov edx, 0x100b6ba0
mov ecx, 0x100b6fa0
call fcn.1000fb80
add esp, 8
cmp byte [0x100b6da0], 0
je 0x1000df7d
push 0x100b6b1c
push 0x100b6b28
mov edx, 0x100b6da0
mov ecx, 0x100b73a0
call fcn.1000fb80
add esp, 8
cmp byte [0x100b7ba0], 0
je 0x1000dfa2
push 0x100b6b2c
push 0x100b6b24
mov edx, 0x100b7ba0
mov ecx, 0x100b77a0
call fcn.1000fb80
add esp, 8
mov ecx, dword [0x100b6b60]
test ecx, ecx
je 0x1000e028
cmp byte [0x100b7da1], 0
mov edx, 7
mov dword [esp + 0x10], ecx
xorps xmm1, xmm1
mov dword [esp + 0x14], 0x10010160
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], edx
movups xmm0, xmmword [esp + 0x10]
mov word [esp + 0x30], pe_nt_image_headers32
mov eax, dword [esp + 0x30]
movups xmmword [0x100b4190], xmm0
mov dword [0x100b41b0], eax
movups xmmword [0x100b41a0], xmm1
je 0x1000e028
push edx
push ecx
push 0x100b41a0
call fcn.100568a0
mov edx, dword [0x100b4194]
add esp, 0xc
mov ecx, dword [0x100b4190]
push dword [0x100b419c]
call fcn.10009230
add esp, 4
mov byte [0x100b41b0], 1
cmp dword [0x100b6b98], 0
je 0x1000e03f
cmp byte [0x100b7da3], 0
je 0x1000e03f
call fcn.10010440
mov eax, dword [0x100b6b40]
test eax, eax
je 0x1000e0a0
add eax, 7
mov dword [esp + 0x14], 0x1000fcd0
cmp byte [0x100b7da4], 0
xorps xmm1, xmm1
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x100b6b3c
mov dword [esp + 0x1c], 6
movups xmm0, xmmword [esp + 0x10]
mov word [esp + 0x30], pe_nt_image_headers32
mov eax, dword [esp + 0x30]
movups xmmword [0x100b416c], xmm0
mov dword [0x100b418c], eax
movups xmmword [0x100b417c], xmm1
je 0x1000e0a0
mov ecx, 0x100b416c
call fcn.10001560
mov ecx, dword [esp + 0x4c]
pop esi
xor ecx, esp
call fcn.10054aad
mov esp, ebp
pop ebp
ret