Function at 0x10001e40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x10005004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x20]
push edi
push eax
push 0x40
mov edi, 8
mov dword [ebp - 0x14], 0x247c8166
push edi
push 0x654711
mov dword [ebp - 0x10], 0x75000118
mov word [ebp - 0x2c], 0x85fe
mov dword [ebp - 0x28], 0xfffffffe
mov dword [ebp - 0x34], 0
mov word [ebp - 0x38], 0x9090
mov byte [ebp - 0x21], 0x90
mov word [ebp - 0x30], 0x9090
mov dword [ebp - 0xc], 0x90909090
mov word [ebp - 8], 0x9090
mov dword [ebp - 0x1c], 0x90909090
mov dword [ebp - 0x18], 0x90909090
call esi
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [0x654711], eax
mov dword [0x654715], ecx
nop dword [eax]
sub edi, 1
jne 0x10001ed0
push ebx
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push edi
push 0x654719
call esi
cmp byte [0x100050b9], 0
je 0x10001f7d
lea eax, [ebp - 0x20]
mov edi, 0x657e58
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 0x20]
mov byte [edi], 0
push eax
push dword [ebp - 0x20]
push 0
push 0x657e59
call esi
mov edi, dword [0x100050c0]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
mov ebx, 0x657e5e
push ebx
call esi
movzx eax, byte [edi]
mov byte [ebx], al
movzx eax, byte [edi + 1]
mov byte [0x657e5f], al
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 0
push 0x657e60
call esi
mov edi, dword [0x100050c4]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
mov ebx, 0x657e65
push ebx
call esi
movzx eax, byte [edi]
mov byte [ebx], al
movzx eax, byte [edi + 1]
mov byte [0x657e66], al
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 0
push 0x657e67
call esi
lea eax, [ebp - 0x20]
mov edi, 0x658d05
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 0x20]
mov byte [edi], 0
push eax
push dword [ebp - 0x20]
push 0
push 0x658d06
call esi
lea eax, [ebp - 0x20]
mov edi, 0x658d0a
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 0x20]
mov byte [edi], 0
push eax
push dword [ebp - 0x20]
push 0
push 0x658d0b
call esi
lea eax, [ebp - 0x20]
mov edi, 0x658d00
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 0x20]
mov byte [edi], 0
push eax
push dword [ebp - 0x20]
push 0
push 0x658d01
call esi
cmp byte [0x100050b9], 0
je 0x10002024
lea eax, [ebp - 0x20]
mov edi, 2
push eax
push 0x40
push edi
push 0x674750
call esi
mov ax, word [ebp - 0x2c]
mov word [0x674750], ax
nop dword [eax]
sub edi, 1
jne 0x10002010
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push edi
push 0x674752
call esi
cmp byte [0x100050b8], 0
lea eax, [ebp - 0x28]
lea edi, [ebp - 0x34]
mov ebx, 4
cmove edi, eax
lea eax, [ebp - 0x20]
push eax
push 0x40
push ebx
push 0x67a9d9
call esi
mov eax, dword [edi]
mov dword [0x67a9d9], eax
nop
sub ebx, 1
jne 0x10002050
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push ebx
push 0x67a9dd
call esi
cmp byte [0x100050b9], bl
je 0x10002096
cmp byte [0x100050b8], bl
je 0x10002096
lea eax, [ebp - 0x20]
mov edi, 0x67a9ef
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 0x20]
mov byte [edi], 0xa
push eax
push dword [ebp - 0x20]
push ebx
push 0x67a9f0
call esi
lea eax, [ebp - 0x20]
mov edi, 0x6a91c6
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 0x20]
mov byte [edi], 6
push eax
push dword [ebp - 0x20]
push 0
push 0x6a91c7
call esi
lea eax, [ebp - 0x20]
mov edi, 0x654f52
push eax
push 0x40
push 6
push edi
call esi
lea eax, [ebp - 0x20]
mov byte [edi], 0x90
push eax
push dword [ebp - 0x20]
mov dword [0x654f53], 0x90909090
push 0
push 0x654f58
mov byte [0x654f57], 0x90
call esi
lea eax, [ebp - 0x20]
mov edi, 0x654fd7
push eax
push 0x40
push 2
push edi
call esi
lea eax, [ebp - 0x20]
mov byte [edi], 0x90
push eax
push dword [ebp - 0x20]
mov byte [0x654fd8], 0x90
push 0
push 0x654fd9
call esi
lea eax, [ebp - 0x20]
mov edi, 0x655015
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 0x20]
mov byte [edi], 0xeb
push eax
push dword [ebp - 0x20]
push 0
push 0x655016
call esi
mov eax, dword [0x100050c8]
mov edi, 0x7df135
mov ebx, dword [0x100050cc]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x20]
push eax
push 0x40
push ebx
push edi
call esi
test ebx, ebx
je 0x1000216f
mov ecx, dword [ebp - 0x28]
nop
mov al, byte [ecx + edi - 0x7df135]
mov byte [edi], al
inc edi
sub ebx, 1
jne 0x10002160
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push ebx
push edi
call esi
lea eax, [ebp - 0x20]
mov edi, 0x580c7c
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 0x20]
mov byte [edi], 0xeb
push eax
push dword [ebp - 0x20]
push 0
push 0x580c7d
call esi
lea eax, [ebp - 0x20]
mov edi, 0x70a7d8
push eax
push 0x40
push 4
push edi
call esi
movzx eax, byte [0x100050a8]
mov byte [edi], al
movzx eax, byte [0x100050a9]
mov byte [0x70a7d9], al
movzx eax, byte [0x100050aa]
mov byte [0x70a7da], al
movzx eax, byte [0x100050ab]
mov byte [0x70a7db], al
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 0
push 0x70a7dc
call esi
lea eax, [ebp - 0x20]
mov edi, 0x70a7a4
push eax
push 0x40
push 4
push edi
call esi
movzx eax, byte [0x100050ac]
mov byte [edi], al
movzx eax, byte [0x100050ad]
mov byte [0x70a7a5], al
movzx eax, byte [0x100050ae]
mov byte [0x70a7a6], al
movzx eax, byte [0x100050af]
mov byte [0x70a7a7], al
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 0
push 0x70a7a8
call esi
lea eax, [ebp - 0x20]
mov edi, 0x70a798
push eax
push 0x40
push 8
push edi
call esi
movzx eax, byte [0x100050b0]
mov byte [edi], al
movzx eax, byte [0x100050b1]
mov byte [0x70a799], al
movzx eax, byte [0x100050b2]
mov byte [0x70a79a], al
movzx eax, byte [0x100050b3]
mov byte [0x70a79b], al
movzx eax, byte [0x100050b4]
mov byte [0x70a79c], al
movzx eax, byte [0x100050b5]
mov byte [0x70a79d], al
movzx eax, byte [0x100050b6]
mov byte [0x70a79e], al
movzx eax, byte [0x100050b7]
mov byte [0x70a79f], al
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 0
push 0x70a7a0
call esi
cmp byte [0x100050ba], 0
pop ebx
je 0x100022f7
lea eax, [ebp - 0x20]
mov edi, 3
push eax
push 0x40
push edi
push 0x66a2e4
call esi
mov ax, word [ebp - 0x38]
mov ecx, 0x66a2e4
mov word [ecx], ax
mov al, byte [ebp - 0x21]
mov byte [ecx + 2], al
sub edi, 1
jne 0x100022e3
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push edi
push 0x66a2e7
call esi
cmp byte [0x100050bb], 0
je 0x10002374
lea eax, [ebp - 0x20]
mov edi, 2
push eax
push 0x40
push edi
push 0x670983
call esi
mov ax, word [ebp - 0x30]
mov word [0x670983], ax
nop dword [eax]
sub edi, 1
jne 0x10002320
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push edi
push 0x670985
call esi
lea eax, [ebp - 0x20]
mov edi, 6
push eax
push 0x40
push edi
push 0x674738
call esi
mov eax, dword [ebp - 0xc]
mov ecx, 0x674738
mov dword [ecx], eax
mov ax, word [ebp - 8]
mov word [ecx + 4], ax
nop dword [eax]
sub edi, 1
jne 0x10002360
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push edi
push 0x67473e
call esi
cmp byte [0x100050bc], 0
je 0x100023a0
lea eax, [ebp - 0x20]
mov edi, 0x406db0
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 0x20]
mov byte [edi], 1
push eax
push dword [ebp - 0x20]
push 0
push 0x406db1
call esi
cmp byte [0x100050bd], 0
je 0x100023e4
lea eax, [ebp - 0x20]
mov edi, 8
push eax
push 0x40
push edi
push 0x6589d7
call esi
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov dword [0x6589d7], eax
mov dword [0x6589db], ecx
nop dword [eax]
sub edi, 1
jne 0x100023d0
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push edi
push 0x6589df
call esi
cmp byte [0x100050be], 0
jne 0x10002410
lea eax, [ebp - 0x20]
mov edi, 0x559a04
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 0x20]
mov byte [edi], 0
push eax
push dword [ebp - 0x20]
push 0
push 0x559a05
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10002595
mov esp, ebp
pop ebp
ret