Function at 0x10018420
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.10017e40
test eax, eax
je 0x1001858a
mov edx, dword [0x10095ddc]
mov esi, dword [0x10095dd8]
sub edx, esi
sar edx, 3
cmp edx, 0x64
jb 0x1001858a
xor ecx, ecx
test edx, edx
je 0x10018481
sub esi, 0x100aa710
nop dword [eax]
mov eax, dword [esi + ecx*8 + 0x100aa710]
mov dword [ecx*8 + 0x100aa710], eax
mov eax, dword [esi + ecx*8 + 0x100aa714]
mov dword [ecx*8 + 0x100aa714], eax
inc ecx
cmp ecx, edx
jb 0x10018460
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor ebx, ebx
mov dword [ebp - 0xc], 0x100aa710
mov dword [ebp - 0x18], 0x6e7532
mov dword [ebp - 0x14], 0x6e821a
mov dword [ebp - 0x20], 0x6e753f
mov dword [ebp - 0x1c], 0x6e8227
nop dword [eax]
mov esi, dword [ebp + ebx*4 - 0x18]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
lea eax, [ebp - 0xc]
push eax
call edi
mov eax, dword [ebp - 0xc]
mov dword [esi], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push esi
call edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0xc]
push 4
push eax
call edi
inc ebx
cmp ebx, 2
jb 0x100184b0
lea eax, [ebp - 8]
push eax
push 0x40
push 4
lea eax, [ebp - 4]
push eax
call edi
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x6e821a
call edi
mov eax, 0x6e821a
mov eax, dword [eax]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
lea eax, [ebp - 4]
push 4
push eax
call edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
push 4
push 0x6e821a
call edi
add dword [ebp - 4], 4
xor ebx, ebx
nop
mov esi, dword [ebp + ebx*4 - 0x20]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
lea eax, [ebp - 4]
push eax
call edi
mov eax, dword [ebp - 4]
mov dword [esi], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push esi
call edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
lea eax, [ebp - 4]
push 4
push eax
call edi
inc ebx
cmp ebx, 2
jb 0x10018540
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor ebx, ebx
mov dword [ebp - 8], 0x10072448
mov dword [ebp - 0x20], 0x6e7532
mov dword [ebp - 0x1c], 0x6e821a
mov dword [ebp - 0x18], 0x6e753f
mov dword [ebp - 0x14], 0x6e8227
mov esi, dword [ebp + ebx*4 - 0x20]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
lea eax, [ebp - 8]
push eax
call edi
mov eax, dword [ebp - 8]
mov dword [esi], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push 4
push esi
call edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 8]
push 4
push eax
call edi
inc ebx
cmp ebx, 2
jb 0x100185b5
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
lea eax, [ebp - 4]
push eax
call edi
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x6e821a
call edi
mov eax, 0x6e821a
mov eax, dword [eax]
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 4]
push 4
push eax
call edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
push 4
push 0x6e821a
call edi
add dword [ebp - 4], 4
xor ebx, ebx
mov esi, dword [ebp + ebx*4 - 0x18]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
lea eax, [ebp - 4]
push eax
call edi
mov eax, dword [ebp - 4]
mov dword [esi], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push 4
push esi
call edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 4]
push 4
push eax
call edi
inc ebx
cmp ebx, 2
jb 0x10018644
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret