Function at 0x10004410
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1000c040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1000c624]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1000c648]
cmp eax, dword [ecx + 4]
jle 0x10004473
push 0x1000c648
call fcn.10007175
add esp, 4
cmp dword [0x1000c648], 0xffffffff
jne 0x10004473
push 0x10008150
mov dword [0x1000c64c], 0x10009370
call fcn.100074de
push 0x1000c648
call fcn.10007124
add esp, 8
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push edi
push eax
push 0x40
push 4
push 0x44e1fc
mov dword [ebp - 8], 0
call esi
test eax, eax
je 0x100044b0
lea eax, [ebp - 8]
mov dword [0x44e1fc], 0x1000c660
push eax
push dword [ebp - 8]
push 4
push 0x44e1fc
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x47de47
call esi
test eax, eax
je 0x100044e4
lea eax, [ebp - 8]
mov dword [0x47de47], 0x1000c660
push eax
push dword [ebp - 8]
push 4
push 0x47de47
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x546b6f
call esi
test eax, eax
je 0x10004518
lea eax, [ebp - 8]
mov dword [0x546b6f], 0x1000c660
push eax
push dword [ebp - 8]
push 4
push 0x546b6f
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x44e6be
call esi
test eax, eax
je 0x1000454c
lea eax, [ebp - 8]
mov dword [0x44e6be], 0x1000c098
push eax
push dword [ebp - 8]
push 4
push 0x44e6be
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x480fd1
call esi
test eax, eax
je 0x10004580
lea eax, [ebp - 8]
mov dword [0x480fd1], 0x1000c098
push eax
push dword [ebp - 8]
push 4
push 0x480fd1
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x49a805
call esi
test eax, eax
je 0x100045b4
lea eax, [ebp - 8]
mov dword [0x49a805], 0x1000c098
push eax
push dword [ebp - 8]
push 4
push 0x49a805
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x49a842
call esi
test eax, eax
je 0x100045e8
lea eax, [ebp - 8]
mov dword [0x49a842], 0x1000c098
push eax
push dword [ebp - 8]
push 4
push 0x49a842
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 1
push 0x44e66e
call esi
test eax, eax
je 0x10004619
lea eax, [ebp - 8]
mov byte [0x44e66e], 0x32
push eax
push dword [ebp - 8]
push 1
push 0x44e66e
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 1
push 0x480f8a
call esi
test eax, eax
je 0x1000464a
lea eax, [ebp - 8]
mov byte [0x480f8a], 0x32
push eax
push dword [ebp - 8]
push 1
push 0x480f8a
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 1
push 0x44e66e
call esi
test eax, eax
je 0x1000467b
lea eax, [ebp - 8]
mov byte [0x44e66e], 0x32
push eax
push dword [ebp - 8]
push 1
push 0x44e66e
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 1
push 0x44e66e
call esi
test eax, eax
je 0x100046ac
lea eax, [ebp - 8]
mov byte [0x44e66e], 0x32
push eax
push dword [ebp - 8]
push 1
push 0x44e66e
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 1
push 0x44e1ec
call esi
test eax, eax
je 0x100046dd
lea eax, [ebp - 8]
mov byte [0x44e1ec], 0x32
push eax
push dword [ebp - 8]
push 1
push 0x44e1ec
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 1
push 0x546b64
call esi
test eax, eax
je 0x1000470e
lea eax, [ebp - 8]
mov byte [0x546b64], 0x32
push eax
push dword [ebp - 8]
push 1
push 0x546b64
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 1
push 0x47da39
call esi
test eax, eax
je 0x1000473f
lea eax, [ebp - 8]
mov byte [0x47da39], 0x32
push eax
push dword [ebp - 8]
push 1
push 0x47da39
call esi
push 0x10009148
push 6
mov dword [ebp - 8], 0
call fcn.10007529
mov ebx, dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov edi, eax
add esp, 8
test edi, edi
je 0x100047c3
lea eax, [ebp - 8]
mov byte [edi], 0xe9
push eax
push 0x40
mov ecx, 0x10004a60
sub ecx, 0x50cdf5
push 6
mov dword [edi + 1], ecx
push 0x50cdf0
mov byte [edi + 5], 0x90
call esi
test eax, eax
je 0x100047c3
mov eax, dword [edi]
mov ecx, 0x50cdf0
mov dword [ecx], eax
mov ax, word [edi + 4]
mov word [ecx + 4], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push ecx
call esi
test eax, eax
je 0x100047c3
push 6
push 0x50cdf0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push edi
call fcn.10007524
add esp, 4
push 0x10009148
push 0xa
mov dword [ebp - 8], 0
call fcn.10007529
mov edi, eax
add esp, 8
test edi, edi
je 0x1000484c
lea eax, [ebp - 8]
mov byte [edi], 0xe9
push eax
push 0x40
mov ecx, 0x10004a90
sub ecx, 0x50cb33
mov dword [edi + 1], ecx
push 0xa
mov dword [edi + 5], 0x90909090
push 0x50cb2e
mov byte [edi + 9], 0x90
call esi
test eax, eax
je 0x1000484c
movq xmm0, qword [edi]
mov ecx, 0x50cb2e
movq qword [ecx], xmm0
mov ax, word [edi + 8]
mov word [ecx + 8], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0xa
push ecx
call esi
test eax, eax
je 0x1000484c
push 0xa
push 0x50cb2e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push edi
call fcn.10007524
add esp, 4
push 0x10009148
push 0xa
mov dword [ebp - 8], 0
call fcn.10007529
mov edi, eax
add esp, 8
test edi, edi
je 0x100048d5
lea eax, [ebp - 8]
mov byte [edi], 0xe9
push eax
push 0x40
mov ecx, 0x10004ac0
sub ecx, 0x4dd30f
mov dword [edi + 1], ecx
push 0xa
mov dword [edi + 5], 0x90909090
push 0x4dd30a
mov byte [edi + 9], 0x90
call esi
test eax, eax
je 0x100048d5
movq xmm0, qword [edi]
mov ecx, 0x4dd30a
movq qword [ecx], xmm0
mov ax, word [edi + 8]
mov word [ecx + 8], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0xa
push ecx
call esi
test eax, eax
je 0x100048d5
push 0xa
push 0x4dd30a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push edi
call fcn.10007524
add esp, 4
push 0x10009148
push 6
mov dword [ebp - 8], 0
call fcn.10007529
mov edi, eax
add esp, 8
test edi, edi
je 0x10004953
lea eax, [ebp - 8]
mov byte [edi], 0xe9
push eax
push 0x40
mov ecx, 0x10004af0
sub ecx, 0x4e7249
push 6
mov dword [edi + 1], ecx
push 0x4e7244
mov byte [edi + 5], 0x90
call esi
test eax, eax
je 0x10004953
mov eax, dword [edi]
mov ecx, 0x4e7244
mov dword [ecx], eax
mov ax, word [edi + 4]
mov word [ecx + 4], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push ecx
call esi
test eax, eax
je 0x10004953
push 6
push 0x4e7244
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push edi
call fcn.10007524
add esp, 4
push 0x10009148
push 6
mov dword [ebp - 8], 0
call fcn.10007529
mov edi, eax
add esp, 8
test edi, edi
je 0x100049d1
lea eax, [ebp - 8]
mov byte [edi], 0xe9
push eax
push 0x40
mov ecx, 0x10004ef0
sub ecx, 0x4f599a
push 6
mov dword [edi + 1], ecx
push 0x4f5995
mov byte [edi + 5], 0x90
call esi
test eax, eax
je 0x100049d1
mov eax, dword [edi]
mov ecx, 0x4f5995
mov dword [ecx], eax
mov ax, word [edi + 4]
mov word [ecx + 4], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push ecx
call esi
test eax, eax
je 0x100049d1
push 6
push 0x4f5995
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push edi
call fcn.10007524
add esp, 4
push 0x10009148
push 6
mov dword [ebp - 8], 0
call fcn.10007529
mov edi, eax
add esp, 8
test edi, edi
je 0x10004a48
lea eax, [ebp - 8]
mov byte [edi], 0xe9
push eax
push 0x40
push 6
mov dword [edi + 1], 0x62c
push 0x4f5ccd
mov byte [edi + 5], 0x90
call esi
test eax, eax
je 0x10004a48
mov eax, dword [edi]
mov ecx, 0x4f5ccd
mov dword [ecx], eax
mov ax, word [edi + 4]
mov word [ecx + 4], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push ecx
call esi
test eax, eax
je 0x10004a48
push 6
push 0x4f5ccd
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push edi
call fcn.10007524
add esp, 4
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10007116
mov esp, ebp
pop ebp
ret