Function at 0x10001190
Capabilities:
Allocate or change rwx memory
Encrypt data using aes
Execute shellcode via indirect call
Reference aes constants

Disassembly:
push esi
push 4
call fcn.100068be
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
push eax
push 0x40
push 0x2e47
push 0x10029eb0
call esi
mov edx, 0x10029eb0
lea ecx, [edx + 0x2e43]
mov eax, edx
cmp edx, ecx
jae 0x100011d2
cmp dword [eax], 0x1009e740
je 0x10001834
inc eax
cmp eax, ecx
jb 0x100011c1
mov edx, 0x10029eb0
nop word [eax + eax]
lea ecx, [edx + 0x2e43]
mov eax, edx
cmp edx, ecx
jae 0x10001201
nop dword [eax]
cmp dword [eax], 0x1009df40
je 0x10001841
inc eax
cmp eax, ecx
jb 0x100011f0
mov edx, 0x10029eb0
lea ecx, [edx + 0x2e43]
mov eax, edx
cmp edx, ecx
jae 0x10001223
cmp dword [eax], 0x1009db40
je 0x1000184e
inc eax
cmp eax, ecx
jb 0x10001212
mov edx, 0x10029eb0
nop dword [eax + eax]
lea ecx, [edx + 0x2e43]
mov eax, edx
cmp edx, ecx
jae 0x10001251
nop dword [eax]
cmp dword [eax], 0x1009e340
je 0x1000185b
inc eax
cmp eax, ecx
jb 0x10001240
mov edx, 0x10029eb0
lea ecx, [edx + 0x2e43]
mov eax, edx
cmp edx, ecx
jae 0x10001273
cmp dword [eax], 0x100a0b40
je 0x10001868
inc eax
cmp eax, ecx
jb 0x10001262
mov edx, 0x10029eb0
nop dword [eax + eax]
lea ecx, [edx + 0x2e43]
mov eax, edx
cmp edx, ecx
jae 0x100012a1
nop dword [eax]
cmp dword [eax], 0x100a0f40
je 0x10001875
inc eax
cmp eax, ecx
jb 0x10001290
mov edx, 0x10029eb0
lea ecx, [edx + 0x2e43]
mov eax, edx
cmp edx, ecx
jae 0x100012c3
cmp dword [eax], 0x100a1340
je 0x10001882
inc eax
cmp eax, ecx
jb 0x100012b2
mov edx, 0x10029eb0
nop dword [eax + eax]
lea ecx, [edx + 0x2e43]
mov eax, edx
cmp edx, ecx
jae 0x100012f1
nop dword [eax]
cmp dword [eax], 0x100a1740
je 0x1000188f
inc eax
cmp eax, ecx
jb 0x100012e0
mov edx, 0x10029eb0
lea ecx, [edx + 0x2e43]
mov eax, edx
cmp edx, ecx
jae 0x10001313
cmp dword [eax], 0x1009cacc
je 0x1000189c
inc eax
cmp eax, ecx
jb 0x10001302
mov edx, 0x10029eb0
nop dword [eax + eax]
lea ecx, [edx + 0x2e43]
mov eax, edx
cmp edx, ecx
jae 0x10001341
nop dword [eax]
cmp dword [eax], 0x1009cad0
je 0x100018a9
inc eax
cmp eax, ecx
jb 0x10001330
mov edx, 0x10029eb0
lea ecx, [edx + 0x2e43]
mov eax, edx
cmp edx, ecx
jae 0x10001363
cmp dword [eax], 0x1009cad4
je 0x100018b6
inc eax
cmp eax, ecx
jb 0x10001352
mov edx, 0x10029eb0
nop dword [eax + eax]
lea ecx, [edx + 0x2e43]
mov eax, edx
cmp edx, ecx
jae 0x10001391
nop dword [eax]
cmp dword [eax], 0x1009cad8
je 0x100018c3
inc eax
cmp eax, ecx
jb 0x10001380
mov edx, 0x10029eb0
lea ecx, [edx + 0x2e43]
mov eax, edx
cmp edx, ecx
jae 0x100013b3
cmp dword [eax], 0x1009cadc
je 0x100018d0
inc eax
cmp eax, ecx
jb 0x100013a2
mov edx, 0x10029eb0
nop dword [eax + eax]
lea ecx, [edx + 0x2e43]
mov eax, edx
cmp edx, ecx
jae 0x100013e1
nop dword [eax]
cmp dword [eax], 0x1009cae0
je 0x100018dd
inc eax
cmp eax, ecx
jb 0x100013d0
mov edx, 0x10029eb0
lea ecx, [edx + 0x2e43]
mov eax, edx
cmp edx, ecx
jae 0x10001403
cmp dword [eax], 0x1009cae4
je 0x100018ea
inc eax
cmp eax, ecx
jb 0x100013f2
mov edx, 0x10029eb0
nop dword [eax + eax]
lea ecx, [edx + 0x2e43]
mov eax, edx
cmp edx, ecx
jae 0x10001431
nop dword [eax]
cmp dword [eax], 0x1009cae8
je 0x100018f7
inc eax
cmp eax, ecx
jb 0x10001420
mov edx, 0x10029eb0
lea ecx, [edx + 0x2e43]
mov eax, edx
cmp edx, ecx
jae 0x10001453
cmp dword [eax], 0x1009caec
je 0x10001904
inc eax
cmp eax, ecx
jb 0x10001442
mov edx, 0x10029eb0
nop dword [eax + eax]
lea ecx, [edx + 0x2e43]
mov eax, edx
cmp edx, ecx
jae 0x10001481
nop dword [eax]
cmp dword [eax], 0x1009caf0
je 0x10001911
inc eax
cmp eax, ecx
jb 0x10001470
mov edx, 0x10029eb0
lea ecx, [edx + 0x2e43]
mov eax, edx
cmp edx, ecx
jae 0x100014a3
cmp dword [eax], 0x1002eaf4
je 0x1000191e
inc eax
cmp eax, ecx
jb 0x10001492
mov edx, 0x10029eb0
nop dword [eax + eax]
lea ecx, [edx + 0x2e43]
mov eax, edx
cmp edx, ecx
jae 0x100014d1
nop dword [eax]
cmp dword [eax], 0x1002eabc
je 0x1000192b
inc eax
cmp eax, ecx
jb 0x100014c0
mov ecx, 0x10029eb0
mov edx, 0x10029eb0
lea eax, [ecx - 0x1002bc60]
add dword [0x10026184], eax
lea eax, [ecx - 0x1002bc60]
add dword [0x10026170], eax
lea eax, [ecx - 0x1002bc60]
add dword [0x10026188], eax
lea eax, [ecx - 0x1002bc60]
add dword [0x10026174], eax
lea eax, [ecx - 0x1002bc60]
add dword [0x1002618c], eax
lea eax, [ecx - 0x1002bc60]
add dword [0x10026178], eax
lea eax, [ecx - 0x1002bc60]
add dword [0x10026190], eax
lea eax, [ecx - 0x1002bc60]
add dword [0x1002617c], eax
lea eax, [ecx - 0x1002bc60]
add dword [0x10026194], eax
sub ecx, 0x1002bc60
add dword [0x10026180], ecx
lea ecx, [edx + 0x2e43]
mov eax, edx
cmp edx, ecx
jae 0x10001571
nop
cmp dword [eax], 0x1002eaa8
je 0x10001938
inc eax
cmp eax, ecx
jb 0x10001560
mov edx, 0x10029eb0
lea ecx, [edx + 0x2e43]
mov eax, edx
cmp edx, ecx
jae 0x10001593
cmp dword [eax], 0x1002eae0
je 0x10001945
inc eax
cmp eax, ecx
jb 0x10001582
push 4
call fcn.100068be
add esp, 4
push eax
push 0x40
push 0x10ea
push 0x10027198
call esi
mov edx, 0x10027198
lea ecx, [edx + 0x10e6]
mov eax, edx
cmp edx, ecx
jae 0x100015d1
nop dword [eax]
cmp dword [eax], 0x1009f340
je 0x10001952
inc eax
cmp eax, ecx
jb 0x100015c0
mov edx, 0x10027198
lea ecx, [edx + 0x10e6]
mov eax, edx
cmp edx, ecx
jae 0x100015f3
cmp dword [eax], 0x1009eb40
je 0x1000195f
inc eax
cmp eax, ecx
jb 0x100015e2
mov edx, 0x10027198
nop dword [eax + eax]
lea ecx, [edx + 0x10e6]
mov eax, edx
cmp edx, ecx
jae 0x10001621
nop dword [eax]
cmp dword [eax], 0x1009ef40
je 0x1000196c
inc eax
cmp eax, ecx
jb 0x10001610
mov edx, 0x10027198
lea ecx, [edx + 0x10e6]
mov eax, edx
cmp edx, ecx
jae 0x10001643
cmp dword [eax], 0x1009f740
je 0x10001979
inc eax
cmp eax, ecx
jb 0x10001632
mov edx, 0x10027198
nop dword [eax + eax]
lea ecx, [edx + 0x10e6]
mov eax, edx
cmp edx, ecx
jae 0x10001671
nop dword [eax]
cmp dword [eax], 0x1009ff40
je 0x10001986
inc eax
cmp eax, ecx
jb 0x10001660
mov edx, 0x10027198
lea ecx, [edx + 0x10e6]
mov eax, edx
cmp edx, ecx
jae 0x10001693
cmp dword [eax], 0x100a0340
je 0x10001993
inc eax
cmp eax, ecx
jb 0x10001682
mov edx, 0x10027198
nop dword [eax + eax]
lea ecx, [edx + 0x10e6]
mov eax, edx
cmp edx, ecx
jae 0x100016c1
nop dword [eax]
cmp dword [eax], 0x1009fb40
je 0x100019a0
inc eax
cmp eax, ecx
jb 0x100016b0
mov edx, 0x10027198
lea ecx, [edx + 0x10e6]
mov eax, edx
cmp edx, ecx
jae 0x100016e3
cmp dword [eax], 0x100a0740
je 0x100019ad
inc eax
cmp eax, ecx
jb 0x100016d2
push 4
call fcn.100068be
add esp, 4
push eax
push 0x40
push 0x1098
push 0x100248d8
call esi
mov edx, 0x100248d8
pop esi
lea ecx, [edx + 0x1094]
mov eax, edx
cmp edx, ecx
jae 0x10001721
nop
cmp dword [eax], 0x1009e740
je 0x100019ba
inc eax
cmp eax, ecx
jb 0x10001710
mov edx, 0x100248d8
lea ecx, [edx + 0x1094]
mov eax, edx
cmp edx, ecx
jae 0x10001743
cmp dword [eax], 0x1009df40
je 0x100019c7
inc eax
cmp eax, ecx
jb 0x10001732
mov edx, 0x100248d8
nop dword [eax + eax]
lea ecx, [edx + 0x1094]
mov eax, edx
cmp edx, ecx
jae 0x10001771
nop dword [eax]
cmp dword [eax], 0x1009db40
je 0x100019d4
inc eax
cmp eax, ecx
jb 0x10001760
mov edx, 0x100248d8
lea ecx, [edx + 0x1094]
mov eax, edx
cmp edx, ecx
jae 0x10001793
cmp dword [eax], 0x1009e340
je 0x100019e1
inc eax
cmp eax, ecx
jb 0x10001782
mov edx, 0x100248d8
nop dword [eax + eax]
lea ecx, [edx + 0x1094]
mov eax, edx
cmp edx, ecx
jae 0x100017c1
nop dword [eax]
cmp dword [eax], 0x1009cf40
je 0x100019ee
inc eax
cmp eax, ecx
jb 0x100017b0
mov edx, 0x100248d8
lea ecx, [edx + 0x1094]
mov eax, edx
cmp edx, ecx
jae 0x100017e3
cmp dword [eax], 0x1009cb40
je 0x100019fb
inc eax
cmp eax, ecx
jb 0x100017d2
mov edx, 0x100248d8
nop dword [eax + eax]
lea ecx, [edx + 0x1094]
mov eax, edx
cmp edx, ecx
jae 0x10001811
nop dword [eax]
cmp dword [eax], 0x1009d340
je 0x10001a08
inc eax
cmp eax, ecx
jb 0x10001800
mov edx, 0x100248d8
lea ecx, [edx + 0x1094]
mov eax, edx
cmp edx, ecx
jae 0x10001833
cmp dword [eax], 0x1009d740
je 0x10001a15
inc eax
cmp eax, ecx
jb 0x10001822
ret
mov edx, eax
mov dword [eax], str.cwko0
jmp 0x100011b5
mov edx, eax
mov dword [eax], 0x1002ccf8
jmp 0x100011e0
mov edx, eax
mov dword [eax], 0x1002d4f8
jmp 0x10001206
mov edx, eax
mov dword [eax], 0x1002dcf8
jmp 0x10001230
mov edx, eax
mov dword [eax], 0x10029ab0
jmp 0x10001256
mov edx, eax
mov dword [eax], 0x10028688
jmp 0x10001280
mov edx, eax
mov dword [eax], 0x10028288
jmp 0x100012a6
mov edx, eax
mov dword [eax], 0x100296b0
jmp 0x100012d0
mov edx, eax
mov dword [eax], 0x100248d4
jmp 0x100012f6
mov edx, eax
mov dword [eax], 0x100248b0
jmp 0x10001320
mov edx, eax
mov dword [eax], 0x100248b4
jmp 0x10001346
mov edx, eax
mov dword [eax], 0x100248b8
jmp 0x10001370
mov edx, eax
mov dword [eax], sym.ehsvc.dll_Ordinal_11
jmp 0x10001396
mov edx, eax
mov dword [eax], 0x100248cc
jmp 0x100013c0
mov edx, eax
mov dword [eax], 0x100248d0
jmp 0x100013e6
mov edx, eax
mov dword [eax], 0x100248c0
jmp 0x10001410
mov edx, eax
mov dword [eax], 0x100248bc
jmp 0x10001436
mov edx, eax
mov dword [eax], 0x100248c8
jmp 0x10001460
mov edx, eax
mov dword [eax], 0x10029688
jmp 0x10001486
mov edx, eax
mov dword [eax], 0x10029688
jmp 0x100014b0
mov edx, eax
mov dword [eax], 0x10026184
jmp 0x10001553
mov edx, eax
mov dword [eax], 0x10026170
jmp 0x10001576
mov edx, eax
mov dword [eax], 0x10028e88
jmp 0x100015b1
mov edx, eax
mov dword [eax], 0x10026598
jmp 0x100015d6
mov edx, eax
mov dword [eax], 0x10026998
jmp 0x10001600
mov edx, eax
mov dword [eax], 0x1002e0f8
jmp 0x10001626
mov edx, eax
mov dword [eax], 0x1002e4f8
jmp 0x10001650
mov edx, eax
mov dword [eax], 0x10025d70
jmp 0x10001676
mov edx, eax
mov dword [eax], 0x10026d98
jmp 0x100016a0
mov edx, eax
mov dword [eax], str.R_tj068_
jmp 0x100016c6
mov edx, eax
mov dword [eax], str.cwko0
jmp 0x10001702
mov edx, eax
mov dword [eax], 0x1002ccf8
jmp 0x10001726
mov edx, eax
mov dword [eax], 0x1002d4f8
jmp 0x10001750
mov edx, eax
mov dword [eax], 0x1002dcf8
jmp 0x10001776
mov edx, eax
mov dword [eax], 0x10029288
jmp 0x100017a0
mov edx, eax
mov dword [eax], 0x10026198
jmp 0x100017c6
mov edx, eax
mov dword [eax], str.cc
jmp 0x100017f0
mov edx, eax
mov dword [eax], 0x10025970
jmp 0x10001816