Function at 0x11018750
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xd0
push esi
push edi
lea eax, [esp + 0xd4]
mov dword [esp + 0x20], 0x447201
push eax
lea edx, [esp + 0x24]
mov dword [esp + 0x28], 0x447248
mov dword [esp + 0x2c], 0x4459f0
mov dword [esp + 0x30], 0x445a0c
mov dword [esp + 0x34], 0x445da7
mov dword [esp + 0x38], 0x445dd1
mov dword [esp + 0x3c], 0x447e43
mov dword [esp + 0x40], 0x447e75
mov dword [esp + 0x44], 0x447ee2
mov dword [esp + 0x48], 0x447efe
mov dword [esp + 0x4c], 0x447db5
mov dword [esp + 0x50], 0x44a705
mov dword [esp + 0x54], 0x44aa28
mov dword [esp + 0x58], 0x448354
mov dword [esp + 0x5c], 0x4485ac
mov dword [esp + 0x60], 0x4487ff
mov dword [esp + 0x64], 0x448ca0
mov dword [esp + 0x68], 0x4497a0
mov dword [esp + 0x6c], 0x449aa0
mov dword [esp + 0x70], 0x449c2c
mov dword [esp + 0x74], 0x44ab4c
mov dword [esp + 0x78], 0x44ab6a
mov dword [esp + 0x7c], 0x44ac23
mov dword [esp + 0x80], 0x44ae4d
mov dword [esp + 0x84], 0x44af94
mov dword [esp + 0x88], 0x44afd5
mov dword [esp + 0x8c], 0x44b015
mov dword [esp + 0x90], 0x44ad7b
mov dword [esp + 0x94], 0x44ae88
mov dword [esp + 0x98], 0x46ee04
mov dword [esp + 0x9c], 0x4753c1
mov dword [esp + 0xa0], 0x475400
mov dword [esp + 0xa4], 0x47559f
mov dword [esp + 0xa8], 0x4755f5
mov dword [esp + 0xac], 0x47005a
mov dword [esp + 0xb0], 0x47008f
mov dword [esp + 0xb4], 0x470401
mov dword [esp + 0xb8], 0x47043e
mov dword [esp + 0xbc], 0x47080e
mov dword [esp + 0xc0], 0x474e35
mov dword [esp + 0xc4], 0x474e76
mov dword [esp + 0xc8], 0x4750fe
mov dword [esp + 0xcc], 0x475139
mov dword [esp + 0xd0], 0x4733df
mov dword [esp + 0xd4], 0x47343a
call fcn.11018eb0
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x447190
call edi
mov eax, 0x11018420
sub eax, 0x447194
mov dword [0x447190], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x447190
call edi
lea eax, [esp + 0x20]
mov dword [esp + 0xc], 0x445997
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], 0x44a6e4
push eax
push ecx
mov ecx, 0x11018480
mov dword [esp + 0x1c], 0x448333
mov dword [esp + 0x20], 0x4487ce
mov dword [esp + 0x24], 0x44976f
call fcn.1100fcf0
cmp byte [0x110c673a], 0
mov eax, 0xc8
mov ecx, 0x64
mov esi, dword [0x110c0abc]
cmovne eax, ecx
sub esi, eax
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x44a03e
call edi
lea eax, [esp + 8]
mov dword [0x44a03e], esi
push eax
push dword [esp + 0xc]
push 4
push 0x44a03e
call edi
mov esi, dword [0x110c0ac0]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x44a02a
call edi
lea eax, [esp + 8]
mov dword [0x44a02a], esi
push eax
push dword [esp + 0xc]
push 4
push 0x44a02a
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x4462a8
call edi
mov esi, 0x110184a0
lea eax, [esi - 0x4462ac]
mov dword [0x4462a8], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x4462a8
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x446388
call edi
lea eax, [esp + 8]
sub esi, 0x44638c
push eax
push dword [esp + 0xc]
mov dword [0x446388], esi
push 4
push 0x446388
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x447901
call edi
mov esi, 0x11018520
lea eax, [esi - 0x447905]
mov dword [0x447901], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x447901
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x447a47
call edi
sub esi, 0x447a4b
lea eax, [esp + 8]
mov dword [0x447a47], esi
push eax
push dword [esp + 0xc]
push 4
push 0x447a47
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x44af3a
call edi
mov eax, 0x11018540
sub eax, 0x44af3e
mov dword [0x44af3a], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x44af3a
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x46edca
call edi
mov eax, 0x110184c0
sub eax, 0x46edce
mov dword [0x46edca], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x46edca
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 5
push 0x46edd8
call edi
mov eax, 0x110184e0
mov byte [0x46edd8], 0xe8
sub eax, 0x46eddd
mov dword [0x46edd9], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 5
push 0x46edd8
call edi
lea eax, [esp + 0x20]
mov dword [esp + 0xc], 0x474f76
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], 0x474ff9
push eax
push ecx
mov ecx, 0x11018500
mov dword [esp + 0x1c], 0x475241
mov dword [esp + 0x20], 0x4752c2
mov dword [esp + 0x24], 0x449661
call fcn.1100fcf0
cmp byte [0x110c673a], 0
je 0x11018bce
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x4472d9
call edi
mov eax, 0x11018470
sub eax, 0x4472dd
mov dword [0x4472d9], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x4472d9
call edi
cmp byte [0x110c09b2], 0
je 0x11018ea6
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x44ab7a
call edi
mov eax, 0x11018660
sub eax, 0x44ab7e
mov dword [0x44ab7a], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x44ab7a
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 2
push 0x447255
call edi
mov eax, 0xd269
mov word [0x447255], ax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 2
push 0x447255
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x447257
call edi
lea eax, [esp + 8]
mov dword [0x447257], 0x13
push eax
push dword [esp + 0xc]
push 4
push 0x447257
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x44725b
call edi
lea eax, [esp + 8]
mov byte [0x44725b], 0x90
push eax
push dword [esp + 0xc]
push 1
push 0x44725b
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 2
push 0x44725c
call edi
mov eax, 0x3eb
mov word [0x44725c], ax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 2
push 0x44725c
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x44af9d
call edi
lea eax, [esp + 8]
mov byte [0x44af9d], 0x14
push eax
push dword [esp + 0xc]
push 1
push 0x44af9d
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x44afeb
call edi
lea eax, [esp + 8]
mov dword [0x44afeb], 0xdb
push eax
push dword [esp + 0xc]
push 4
push 0x44afeb
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x44af47
call edi
lea eax, [esp + 8]
mov dword [0x44af47], 0x13
push eax
push dword [esp + 0xc]
push 4
push 0x44af47
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x44af51
call edi
lea eax, [esp + 8]
mov dword [0x44af51], 0xdb
push eax
push dword [esp + 0xc]
push 4
push 0x44af51
call edi
mov eax, dword [0x51874c]
add eax, 5
mov dword [0x51874c], eax
mov eax, dword [0x518754]
add eax, 5
mov dword [0x518754], eax
mov eax, dword [0x51875c]
add eax, 5
mov dword [0x51875c], eax
mov eax, dword [0x518764]
add eax, 5
mov dword [0x518764], eax
mov eax, dword [0x51876c]
add eax, 5
mov dword [0x51876c], eax
mov eax, dword [0x518774]
add eax, 5
mov dword [0x518774], eax
mov eax, dword [0x51877c]
add eax, 5
mov dword [0x51877c], eax
mov eax, dword [0x518784]
add eax, 5
mov dword [0x518784], eax
mov eax, dword [0x51878c]
add eax, 5
mov dword [0x51878c], eax
mov eax, dword [0x518794]
add eax, 5
mov dword [0x518794], eax
mov eax, dword [0x51879c]
add eax, 5
mov dword [0x51879c], eax
mov eax, dword [0x5187a4]
add eax, 5
mov dword [0x5187a4], eax
mov eax, dword [0x5187ac]
add eax, 5
mov dword [0x5187ac], eax
mov eax, dword [0x5187b4]
add eax, 5
mov dword [0x5187b4], eax
sub esp, 0x28
mov eax, dword [0x5187bc]
mov ecx, 0x110186c0
add eax, 5
mov dword [0x5187bc], eax
mov eax, dword [0x5187c4]
add eax, 5
mov dword [0x5187c4], eax
mov eax, esp
mov dword [eax + 0x24], 0
test ecx, ecx
je 0x11018e5d
mov dword [eax], 0x110b3d0c
mov dword [eax + 4], 0x110186c0
mov dword [eax + 0x24], eax
lea eax, [esp + 0x34]
mov ecx, 0x110e510c
push eax
call fcn.110053e0
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x11018ea6
push dword [esp + 8]
mov edx, dword [esp + 0x14]
push ecx
call fcn.11008d10
mov edx, dword [esp + 0x14]
mov eax, 0x66666667
mov ecx, dword [esp + 0xc]
sub edx, ecx
imul edx
push 0x28
mov eax, edx
sar eax, 4
mov edx, eax
shr edx, 0x1f
add edx, eax
call fcn.11004ac0
pop edi
pop esi
mov esp, ebp
pop ebp
ret