Function at 0x10008660
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
cmp byte [0x100aa160], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push edi
je 0x100086ad
mov esi, dword [0x100aa14c]
lea eax, [esp + 0xc]
mov edi, dword [0x100aa140]
push eax
push 0x40
push esi
push edi
call ebx
push esi
push 0x100aa150
push edi
call fcn.1004c810
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push esi
push edi
call ebx
mov byte [0x100aa160], 0
cmp byte [0x100aa0ac], 0
je 0x100086f0
mov esi, dword [0x100aa098]
lea eax, [esp + 0xc]
mov edi, dword [0x100aa08c]
push eax
push 0x40
push esi
push edi
call ebx
push esi
push 0x100aa09c
push edi
call fcn.1004c810
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push esi
push edi
call ebx
mov byte [0x100aa0ac], 0
cmp byte [0x100aa0d0], 0
je 0x10008733
mov esi, dword [0x100aa0bc]
lea eax, [esp + 0xc]
mov edi, dword [0x100aa0b0]
push eax
push 0x40
push esi
push edi
call ebx
push esi
push 0x100aa0c0
push edi
call fcn.1004c810
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push esi
push edi
call ebx
mov byte [0x100aa0d0], 0
cmp byte [0x100aa1a8], 0
je 0x10008776
mov esi, dword [0x100aa194]
lea eax, [esp + 0xc]
mov edi, dword [0x100aa188]
push eax
push 0x40
push esi
push edi
call ebx
push esi
push 0x100aa198
push edi
call fcn.1004c810
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push esi
push edi
call ebx
mov byte [0x100aa1a8], 0
cmp byte [0x100aa184], 0
je 0x100087b9
mov esi, dword [0x100aa170]
lea eax, [esp + 0xc]
mov edi, dword [0x100aa164]
push eax
push 0x40
push esi
push edi
call ebx
push esi
push 0x100aa174
push edi
call fcn.1004c810
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push esi
push edi
call ebx
mov byte [0x100aa184], 0
cmp byte [0x100aa13c], 0
je 0x100087fc
mov esi, dword [0x100aa128]
lea eax, [esp + 0xc]
mov edi, dword [0x100aa11c]
push eax
push 0x40
push esi
push edi
call ebx
push esi
push 0x100aa12c
push edi
call fcn.1004c810
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push esi
push edi
call ebx
mov byte [0x100aa13c], 0
cmp byte [0x100aa118], 0
je 0x1000883f
mov esi, dword [0x100aa104]
lea eax, [esp + 0xc]
mov edi, dword [0x100aa0f8]
push eax
push 0x40
push esi
push edi
call ebx
push esi
push 0x100aa108
push edi
call fcn.1004c810
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push esi
push edi
call ebx
mov byte [0x100aa118], 0
cmp byte [0x100aa0f4], 0
je 0x10008882
mov esi, dword [0x100aa0e0]
lea eax, [esp + 0xc]
mov edi, dword [0x100aa0d4]
push eax
push 0x40
push esi
push edi
call ebx
push esi
push 0x100aa0e4
push edi
call fcn.1004c810
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push esi
push edi
call ebx
mov byte [0x100aa0f4], 0
cmp byte [0x100aa040], 0
je 0x100088c5
mov esi, dword [0x100aa02c]
lea eax, [esp + 0xc]
mov edi, dword [0x100aa020]
push eax
push 0x40
push esi
push edi
call ebx
push esi
push 0x100aa030
push edi
call fcn.1004c810
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push esi
push edi
call ebx
mov byte [0x100aa040], 0
cmp byte [0x100aa088], 0
je 0x10008908
mov esi, dword [0x100aa074]
lea eax, [esp + 0xc]
mov edi, dword [0x100aa068]
push eax
push 0x40
push esi
push edi
call ebx
push esi
push 0x100aa078
push edi
call fcn.1004c810
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push esi
push edi
call ebx
mov byte [0x100aa088], 0
call fcn.1000dc20
call fcn.10008530
mov ecx, dword [0x100a9f20]
test ecx, ecx
je 0x10008923
mov al, byte [0x100a88d7]
mov byte [ecx], al
mov ecx, dword [0x100a9f1c]
test ecx, ecx
je 0x10008934
mov al, byte [0x100a88d6]
mov byte [ecx], al
mov eax, dword [0x100a9b80]
test eax, eax
je 0x10008958
mov eax, dword [eax]
test eax, eax
je 0x10008958
mov eax, dword [eax + 0x68]
test eax, eax
je 0x10008958
mov eax, dword [eax + 0x54]
test eax, eax
je 0x10008958
mov dword [eax + 0x28], 0x3f800000
cmp byte [0x100aa23c], 0
je 0x1000899b
mov esi, dword [0x100aa228]
lea eax, [esp + 0xc]
mov edi, dword [0x100aa21c]
push eax
push 0x40
push esi
push edi
call ebx
push esi
push 0x100aa22c
push edi
call fcn.1004c810
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push esi
push edi
call ebx
mov byte [0x100aa23c], 0
cmp byte [0x100aa1cc], 0
je 0x100089de
mov esi, dword [0x100aa1b8]
lea eax, [esp + 0xc]
mov edi, dword [0x100aa1ac]
push eax
push 0x40
push esi
push edi
call ebx
push esi
push 0x100aa1bc
push edi
call fcn.1004c810
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push esi
push edi
call ebx
mov byte [0x100aa1cc], 0
call fcn.1000de30
call fcn.1000d7c0
mov eax, dword [0x100a9c34]
test eax, eax
je 0x10008a25
cmp dword [0x100a9bf0], 0
je 0x10008a25
lea ecx, [esp + 0xc]
push ecx
push 0x40
push 5
push eax
call ebx
mov ecx, dword [0x100a9c34]
mov eax, dword [0x100a9bf0]
mov byte [ecx], 0xe9
mov dword [ecx + 1], eax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push 5
push ecx
call ebx
pop edi
pop esi
pop ebx
pop ecx
ret