Function at 0x100b1e00
Capabilities:
Allocate or change rwx memory
Check if file exists
Execute shellcode via indirect call
Get file attributes

Disassembly:
push ecx
push esi
push 0x10
call fcn.100e9ea6
xorps xmm0, xmm0
push 0x10
movups xmmword [eax], xmm0
mov dword [0x10175ff8], eax
call fcn.100e9ea6
xorps xmm0, xmm0
mov dword [0x10175ff0], eax
push 0x40
movups xmmword [eax], xmm0
call fcn.100ea11b
mov ecx, dword [0x10175ff8]
push 0x40
mov dword [ecx], eax
call fcn.100ea11b
mov ecx, dword [0x10175ff0]
push 0x10
mov dword [ecx], eax
call fcn.100e9ea6
xorps xmm0, xmm0
push 0x10
movups xmmword [eax], xmm0
mov dword [0x10175ffc], eax
call fcn.100e9ea6
xorps xmm0, xmm0
mov dword [0x10175ff4], eax
push 0x40
movups xmmword [eax], xmm0
call fcn.100ea11b
mov ecx, dword [0x10175ffc]
push 0x40
mov dword [ecx], eax
call fcn.100ea11b
mov ecx, dword [0x10175ff4]
add esp, 0x20
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push str.AppearancehmR01S00
mov dword [ecx], eax
call esi
cmp eax, 0xffffffff
jne 0x100b1ebf
push str.AppearancehfR01S00
call esi
cmp eax, 0xffffffff
jne 0x100b1ebf
push str.AppearancehmR01S00.dat
call esi
cmp eax, 0xffffffff
jne 0x100b1ebf
push str.AppearancehfR01S00.dat
call esi
cmp eax, 0xffffffff
je 0x100b1ec6
mov byte [0x10176011], 1
push str.AppearancehmR00S01
call esi
cmp eax, 0xffffffff
jne 0x100b1ef6
push str.AppearancehfR00S01
call esi
cmp eax, 0xffffffff
jne 0x100b1ef6
push str.AppearancehmR00S01.dat
call esi
cmp eax, 0xffffffff
jne 0x100b1ef6
push str.AppearancehfR00S01.dat
call esi
cmp eax, 0xffffffff
je 0x100b1efd
mov byte [0x10176010], 1
push 1
push 0x100af6f0
mov edx, 0x4deee5
mov cl, 0xe8
call fcn.10012100
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4196b1
call esi
mov eax, 0x100af7c0
sub eax, 0x4196b5
mov dword [0x4196b1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x4196b1
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x418ca3
call esi
mov eax, 0x100af880
sub eax, 0x418ca7
mov dword [0x418ca3], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x418ca3
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x418b39
call esi
mov eax, 0x100af7e0
mov byte [0x418b39], 0xe8
sub eax, 0x418b3e
mov dword [0x418b3a], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x418b39
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x49f9da
call esi
mov eax, 0x100af710
mov byte [0x49f9da], 0xe8
sub eax, 0x49f9df
mov dword [0x49f9db], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x49f9da
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x519400
call esi
lea eax, [esp + 4]
mov dword [0x519400], 0x100af7a0
push eax
push dword [esp + 8]
push 4
push 0x519400
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x43a789
call esi
lea eax, [esp + 4]
mov dword [0x43a789], 0x1aa
push eax
push dword [esp + 8]
push 4
push 0x43a789
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4362be
call esi
lea eax, [esp + 4]
mov dword [0x4362be], 0x2484a
push eax
push dword [esp + 8]
push 4
push 0x4362be
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4362f2
call esi
lea eax, [esp + 4]
mov dword [0x4362f2], 0x22e
push eax
push dword [esp + 8]
push 4
push 0x4362f2
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x43631e
call esi
lea eax, [esp + 4]
mov dword [0x43631e], 0x22e
push eax
push dword [esp + 8]
push 4
push 0x43631e
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x436262
call esi
lea eax, [esp + 4]
mov dword [0x436262], 0x24834
push eax
push dword [esp + 8]
push 4
push 0x436262
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x43628a
call esi
lea eax, [esp + 4]
mov dword [0x43628a], 0x22e
push eax
push dword [esp + 8]
push 4
push 0x43628a
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4363ce
call esi
lea eax, [esp + 4]
mov dword [0x4363ce], 0x1c0
push eax
push dword [esp + 8]
push 4
push 0x4363ce
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x43641c
call esi
lea eax, [esp + 4]
mov dword [0x43641c], 0x247
push eax
push dword [esp + 8]
push 4
push 0x43641c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x43a74c
call esi
lea eax, [esp + 4]
mov dword [0x43a74c], 0x9d
push eax
push dword [esp + 8]
push 4
push 0x43a74c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x43a75b
call esi
lea eax, [esp + 4]
mov dword [0x43a75b], 0x1be
push eax
push dword [esp + 8]
push 4
push 0x43a75b
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x436220
call esi
lea eax, [esp + 4]
mov dword [0x436220], 0xe40
push eax
push dword [esp + 8]
push 4
push 0x436220
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x43a71e
call esi
lea eax, [esp + 4]
mov dword [0x43a71e], 0x9b
push eax
push dword [esp + 8]
push 4
push 0x43a71e
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x43a72a
call esi
lea eax, [esp + 4]
mov dword [0x43a72a], 0x1bc
push eax
push dword [esp + 8]
push 4
push 0x43a72a
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4361c4
call esi
lea eax, [esp + 4]
mov dword [0x4361c4], 0x1be
push eax
push dword [esp + 8]
push 4
push 0x4361c4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4361d9
call esi
lea eax, [esp + 4]
mov dword [0x4361d9], 0xc2
push eax
push dword [esp + 8]
push 4
push 0x4361d9
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4361de
call esi
lea eax, [esp + 4]
mov dword [0x4361de], 0x1be
push eax
push dword [esp + 8]
push 4
push 0x4361de
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x43647c
call esi
lea eax, [esp + 4]
mov dword [0x43647c], 0x253
push eax
push dword [esp + 8]
push 4
push 0x43647c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4364fa
call esi
lea eax, [esp + 4]
mov dword [0x4364fa], 0x269
push eax
push dword [esp + 8]
push 4
push 0x4364fa
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x436567
call esi
lea eax, [esp + 4]
mov dword [0x436567], 0x269
push eax
push dword [esp + 8]
push 4
push 0x436567
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 1
push 0x42df5e
call esi
lea eax, [esp + 4]
mov byte [0x42df5e], 0xf1
push eax
push dword [esp + 8]
push 1
push 0x42df5e
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x42df60
call esi
mov eax, 0x100b1ce0
sub eax, 0x42df64
mov dword [0x42df60], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x42df60
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 1
push 0x42e162
call esi
lea eax, [esp + 4]
mov byte [0x42e162], 0xf1
push eax
push dword [esp + 8]
push 1
push 0x42e162
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x42e164
call esi
mov eax, 0x100b1db0
sub eax, 0x42e168
mov dword [0x42e164], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x42e164
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x42613b
call esi
mov eax, 0x100b1c90
sub eax, 0x42613f
mov dword [0x42613b], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x42613b
call esi
pop esi
pop ecx
ret