Function at 0x10027520
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
push 0x40485a
call ebx
mov byte [0x40485a], 0xe9
mov eax, 0x1002bd90
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 0xffbfb7a1
mov dword [0x40485b], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 5
push 0x40485a
call ebx
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
push 0x4e03bf
call ebx
mov byte [0x4e03bf], 0xe9
mov eax, 0x1002bcf0
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 0xffb1fc3c
mov dword [0x4e03c0], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 5
push 0x4e03bf
call ebx
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
push 0x4e1803
call ebx
mov byte [0x4e1803], 0xe9
mov eax, 0x1002afb0
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 0xffb1e7f8
mov dword [0x4e1804], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 5
push 0x4e1803
call ebx
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
push 0x472c9a
call ebx
mov byte [0x472c9a], 0xe9
mov eax, 0x1002c8c0
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 0xffb8d361
mov dword [0x472c9b], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 5
push 0x472c9a
call ebx
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
push 0x504df4
call ebx
mov byte [0x504df4], 0xe9
mov eax, 0x1002c920
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 0xffafb207
mov dword [0x504df5], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 5
push 0x504df4
call ebx
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
push 0x504e0f
call ebx
mov byte [0x504e0f], 0xe9
mov eax, 0x1002c840
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 0xffafb1ec
mov dword [0x504e10], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 5
push 0x504e0f
call ebx
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
push 0x504e1b
call ebx
mov byte [0x504e1b], 0xe9
mov eax, 0x1002c860
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 0xffafb1e0
mov dword [0x504e1c], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 5
push 0x504e1b
call ebx
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
push 0x504b0d
call ebx
mov byte [0x504b0d], 0xe9
mov eax, 0x1002c940
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 0xffafb4ee
mov dword [0x504b0e], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 5
push 0x504b0d
call ebx
lea eax, [ebp - 8]
mov byte [ebp - 1], 0xe9
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0x4dcd7e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, 0x10026a00
sub eax, 0x4dcd83
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push 0x4dcd7f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 2
push 0x4dcd83
call ebx
mov eax, 0x4dcd83
mov ecx, 0x90909090
mov word [eax], cx
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 2
push 0x4dcd83
call ebx
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x4e0d33
call ebx
mov byte [0x4e0d33], 0xe9
mov eax, 0x1002c960
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 0xffb1f2c8
mov dword [0x4e0d34], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x4e0d33
call ebx
pop ebx
mov esp, ebp
pop ebp
ret