Function at 0x100d3540
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Inspect section memory permissions
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10123c45
mov eax, dword fs:[0]
push eax
sub esp, 0xe0
mov eax, dword [0x1016e750]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xa8], ecx
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xb0], edi
mov dword [ebp - 0xd8], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x94]
push dword [ebp + 0x2c]
push str.LoadImageFromMemory:_in__DbgImaginaryFile_s_
push eax
call fcn.10044f30
add esp, 0xc
mov byte [ebp - 4], 1
mov ecx, str.ImaginarySection
mov edx, dword [ebp - 0x94]
call fcn.10043b30
mov byte [ebp - 4], 0
or eax, 0xffffffff
mov edx, dword [ebp - 0x94]
add edx, 0xfffffff0
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x100d35fe
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
movdqa xmm0, xmmword [0x10160b00]
lea eax, [ebp - 0x50]
test edi, edi
mov dword [ebp - 0x50], 1
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x4c], 1
cmove eax, ecx
mov dword [ebp - 0x48], 0x10
cmp dword [ebp - 0xdc], 0
mov dword [ebp - 0x44], 0x10
mov dword [ebp - 0x40], 2
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x38], 0x20
mov dword [ebp - 0x34], 0x20
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x2c], 8
mov dword [ebp - 0x28], 0x80
mov dword [ebp - 0x24], 0x80
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x18], 0x80
mov dword [ebp - 0x14], 0x80
mov dword [ebp - 0x90], 1
mov dword [ebp - 0x8c], 1
movdqu xmmword [ebp - 0x88], xmm0
mov dword [ebp - 0xe8], eax
movdqu xmmword [ebp - 0x78], xmm0
movdqu xmmword [ebp - 0x68], xmm0
movq qword [ebp - 0x58], xmm0
je 0x100d36e5
mov ecx, dword [ebp - 0xd8]
movzx eax, word [ecx + 6]
mov edi, dword [ecx + 0x30]
mov dword [ebp - 0xb4], eax
mov eax, dword [ecx + 0x50]
mov dword [ebp - 0xbc], eax
mov eax, dword [ecx + 0x34]
mov dword [ebp - 0xc4], eax
jmp 0x100d370b
mov ecx, dword [ebp - 0xe0]
mov dword [ebp - 0xc4], 0
movzx eax, word [ecx + 6]
mov edi, dword [ecx + 0x34]
mov dword [ebp - 0xb4], eax
mov eax, dword [ecx + 0x50]
mov dword [ebp - 0xbc], eax
xor ecx, ecx
mov eax, edi
cmp dword [ebp + 0x18], ecx
push 0x40
push ecx
push 2
cmovne eax, ecx
mov dword [ebp - 0x98], eax
lea eax, [ebp - 0xbc]
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 0x98]
push eax
push esi
push dword [ebp - 0xa8]
call dword [0x10174f00]
test eax, eax
jns 0x100d37a0
push eax
push dword [ebp - 0xbc]
lea eax, [ebp - 0x94]
push str._LoadImageFromMemory:_out._NtMapViewOfSection_ImageSize_Iu__failed__Status0x_x
push eax
call fcn.10044f30
add esp, 0x10
mov byte [ebp - 4], 2
mov ecx, str.ImaginarySection
mov edx, dword [ebp - 0x94]
call fcn.10043b30
mov byte [ebp - 4], 0
or ecx, 0xffffffff
mov edx, dword [ebp - 0x94]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100d3dd7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor esi, esi
jmp 0x100d3eda
push edi
push dword [ebp - 0x98]
mov edi, dword [ebp - 0xdc]
mov ecx, str.PE32
push dword [ebp - 0xbc]
test edi, edi
mov eax, str.PE64
cmove eax, ecx
cmp dword [ebp - 0xb0], 0
push eax
mov ecx, str.AsData
mov eax, str.ForExec
cmove eax, ecx
push eax
lea eax, [ebp - 0x94]
push str.LoadImageFromMemory__s_:__s__ImageSize_Iu__ImageBase0x_p__PreferredImageBase0x_p
push eax
call fcn.10044f30
add esp, 0x1c
mov byte [ebp - 4], 3
mov ecx, str.ImaginarySection
mov edx, dword [ebp - 0x94]
call fcn.10043b30
mov byte [ebp - 4], 0
or ecx, 0xffffffff
mov edx, dword [ebp - 0x94]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100d3824
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x98]
test edi, edi
mov edi, dword [ebp - 0xd8]
mov dword [ebp - 0xa8], eax
jne 0x100d3840
mov edi, dword [ebp - 0xe0]
mov edi, dword [edi + 0x54]
push edi
push 0
push 0
push 4
push dword [ebp - 0xd0]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
jne 0x100d38c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x94]
push str._LoadImageFromMemory:_out._MapViewOfFile_Headers__failed__LE_d
push eax
call fcn.10044f30
add esp, 0xc
mov byte [ebp - 4], 4
mov ecx, str.ImaginarySection
mov edx, dword [ebp - 0x94]
call fcn.10043b30
mov byte [ebp - 4], 0
or ecx, 0xffffffff
mov edx, dword [ebp - 0x94]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100d38ad
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x98]
push esi
call dword [0x10174f04]
xor esi, esi
jmp 0x100d3eda
push 0
push edi
push eax
push dword [ebp - 0xa8]
push esi
call dword [0x10174ef8]
test eax, eax
jns 0x100d3904
push ecx
mov ecx, esp
push eax
push str._LoadImageFromMemory:_out._WriteProcessMemory_Headers__failed__Status0x_x
push ecx
call fcn.10044f30
add esp, 0xc
call fcn.100d33c0
add esp, 4
push dword [ebp - 0x98]
push esi
call dword [0x10174f04]
xor esi, esi
jmp 0x100d3eda
lea eax, [ebp - 0xcc]
push eax
push 0x80
push dword [ebp - 0xbc]
push dword [ebp - 0x98]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x100d3947
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
push eax
push str._LoadImageFromMemory:_failed_setting_protection_on_entire_image_block:_LE_d
push ecx
call fcn.10044f30
add esp, 0xc
call fcn.100d33c0
add esp, 4
mov eax, dword [ebp - 0xb4]
mov edx, 4
mov ecx, dword [ebp - 0xd0]
movzx edi, ax
lea eax, [ebp - 0xac]
push 0
push dword [ebp + 0x28]
mov dword [ebp - 0xac], 0
push eax
lea eax, [edi + edi*4]
mov dword [ebp - 0xa8], edi
shl eax, 3
push eax
call fcn.10044930
add esp, 0x10
mov dword [ebp - 0xc4], eax
test eax, eax
jne 0x100d39c5
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push ecx
mov ecx, esp
push eax
push str._LoadImageFromMemory:_out._MapAlignedViewOfFile_Sections__failed__LE_d
push ecx
call fcn.10044f30
add esp, 0xc
call fcn.100d33c0
add esp, 4
push dword [ebp - 0x98]
push esi
call dword [0x10174f04]
xor esi, esi
jmp 0x100d3eda
lea esi, [edi*4]
push esi
call fcn.10104809
add esp, 4
mov dword [ebp - 0x94], eax
push esi
call fcn.10104809
xor edx, edx
mov dword [ebp - 0xb4], eax
add esp, 4
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0x9c], edx
test edi, edi
jle 0x100d3c00
mov ecx, dword [ebp - 0xac]
mov dword [ebp - 0xb0], eax
add ecx, 0xc
mov eax, dword [ebp - 0x94]
sub eax, dword [ebp - 0xb4]
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0xd4], eax
jmp 0x100d3a30
mov edi, dword [ecx + 4]
xor esi, esi
test edi, edi
jne 0x100d3abd
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0xdc], esi
jne 0x100d3a51
mov eax, dword [ebp - 0xe0]
mov edi, dword [eax + 0x38]
push ecx
mov eax, esp
push edi
push edx
push str.LoadImageFromMemory_section_d_:_SizeOfRawData_is_0._SectionAlignment_d
push eax
call fcn.10044f30
add esp, 0x10
call fcn.100d33c0
mov ecx, dword [ebp - 0xa0]
add esp, 4
mov eax, dword [ecx - 4]
test eax, eax
cmovne edi, eax
test edi, edi
je 0x100d3ba8
mov esi, dword [ecx]
add esi, dword [ebp - 0x98]
mov ecx, dword [ebp - 0xa4]
mov edx, esi
push edi
call fcn.100d34e0
mov ecx, eax
add esp, 4
test ecx, ecx
jns 0x100d3ba2
push ecx
mov eax, esp
push ecx
push dword [ebp - 0x9c]
push str._LoadImageFromMemory_section_d__empty_:_ZeroSection_failed__quitting__Status0x_x
push eax
jmp 0x100d3db5
mov esi, dword [ecx]
add esi, dword [ebp - 0x98]
mov eax, dword [ecx + 8]
test eax, eax
jne 0x100d3afc
mov ecx, dword [ebp - 0xa4]
mov edx, esi
push edi
call fcn.100d34e0
mov ecx, eax
add esp, 4
test ecx, ecx
jns 0x100d3ba2
push ecx
mov eax, esp
push ecx
push dword [ebp - 0x9c]
push str._LoadImageFromMemory_section_d_:_ZeroSection_failed__quitting__Status0x_x
push eax
jmp 0x100d3db5
mov ecx, dword [ebp - 0xd0]
mov edx, 4
push 0
push eax
lea eax, [ebp - 0xb8]
mov dword [ebp - 0xb8], 0
push eax
push edi
call fcn.10044930
add esp, 0x10
mov dword [ebp - 0xe4], eax
test eax, eax
je 0x100d3d9e
lea eax, [ebp - 0xcc]
push eax
push 0x40
push edi
push esi
push dword [ebp - 0xa4]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [ebp - 0xa0]
push 0
push dword [eax + 4]
push dword [ebp - 0xb8]
push esi
push dword [ebp - 0xa4]
call dword [0x10174ef8]
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0xcc]
push edi
push esi
push dword [ebp - 0xa4]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push dword [ebp - 0xe4]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [ebp - 0xb8]
test ecx, ecx
js 0x100d3d8c
mov ecx, dword [ebp - 0xa0]
mov eax, dword [ebp - 0xc0]
test eax, eax
je 0x100d3bb6
cmp esi, eax
jae 0x100d3bbc
mov dword [ebp - 0xc0], esi
mov eax, dword [ebp - 0xb0]
add ecx, 0x28
mov edx, dword [ebp - 0xd4]
mov dword [ebp - 0xa0], ecx
mov dword [eax], edi
mov edi, dword [ebp - 0xa8]
mov dword [edx + eax], esi
add eax, 4
mov edx, dword [ebp - 0x9c]
inc edx
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x9c], edx
cmp edx, edi
jl 0x100d3a30
mov eax, dword [ebp - 0xb4]
xor esi, esi
test edi, edi
jle 0x100d3e56
mov edx, dword [ebp - 0xac]
mov ecx, eax
mov dword [ebp - 0x9c], eax
add edx, 0x24
mov eax, dword [ebp - 0x94]
sub eax, dword [ebp - 0xb4]
mov dword [ebp - 0xac], edx
mov dword [ebp - 0xa0], eax
mov eax, dword [edx]
mov ecx, dword [ecx]
mov dword [ebp - 0xc0], ecx
test eax, 0xe0000000
jne 0x100d3c5f
test al, 0x20
je 0x100d3c4d
or eax, 0x60000000
test al, 0x40
je 0x100d3c56
or eax, 0xc0000000
test al, al
jns 0x100d3c5f
or eax, 0xc0000000
mov edi, dword [ebp - 0xe8]
shr eax, 0x1c
mov edi, dword [edi + eax*4]
mov eax, dword [ebp - 0x9c]
push edi
push dword [edx]
push ecx
push ecx
mov ecx, dword [ebp - 0xa0]
push dword [eax + ecx]
lea eax, [edx - 0x24]
push eax
push esi
lea eax, [ebp - 0xb0]
push str.LoadImageFromMemory__d:_hs_:_Addr0x_p__Size_d_0x_x___Characteristics0x_.8x__NewProtect0x_.4x
push eax
call fcn.10044f30
add esp, 0x24
mov byte [ebp - 4], 5
mov ecx, str.ImaginarySection
mov edx, dword [ebp - 0xb0]
call fcn.10043b30
mov byte [ebp - 4], 0
or ecx, 0xffffffff
mov edx, dword [ebp - 0xb0]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100d3cd0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0xa0]
cmp dword [eax + ecx], 0
je 0x100d3dde
mov eax, dword [ebp - 0xc0]
test eax, eax
je 0x100d3dde
mov ecx, dword [ebp - 0xac]
test dword [ecx], 0x4000000
je 0x100d3d28
push ecx
mov eax, esp
push esi
push str.LoadImageFromMemory_section_d_:_has_IMAGE_SCN_MEM_NOT_CACHED
push eax
call fcn.10044f30
add esp, 0xc
call fcn.100d33c0
mov eax, dword [ebp - 0xc0]
add esp, 4
or edi, 0x200
lea ecx, [ebp - 0xcc]
push ecx
mov ecx, dword [ebp - 0xa0]
push edi
push eax
mov eax, dword [ebp - 0x9c]
push dword [eax + ecx]
push dword [ebp - 0xa4]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x100d3e2b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 0xa0]
push ecx
mov ecx, esp
push eax
mov eax, dword [ebp - 0x9c]
push edi
push dword [eax]
push dword [eax + edx]
push esi
push str._LoadImageFromMemory_section_d_:_VirtualProtect_failed_on_loaded_section:_Addr_p__Size0x_x__NewProt0x_x__Status0x_x
push ecx
call fcn.10044f30
add esp, 0x1c
call fcn.100d33c0
add esp, 4
jmp 0x100d3e2b
push ecx
mov eax, esp
push ecx
push dword [ebp - 0x9c]
push str._LoadImageFromMemory_section_d_:_WriteProcessMemory_failed__quitting__Status0x_x
push eax
jmp 0x100d3db5
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push ecx
mov ecx, esp
push eax
push dword [ebp - 0x9c]
push str._LoadImageFromMemory_section_d_:_MapViewOfSection_SectionOfs__failed__quitting__LE_d
push ecx
call fcn.10044f30
add esp, 0x10
call fcn.100d33c0
add esp, 4
push dword [ebp - 0x98]
push dword [ebp - 0xa4]
call dword [0x10174f04]
xor esi, esi
jmp 0x100d3eda
push esi
lea eax, [ebp - 0xb8]
push str.LoadImageFromMemory_section_d_:_empty_section._Skipping.
push eax
call fcn.10044f30
add esp, 0xc
mov byte [ebp - 4], 6
mov ecx, str.ImaginarySection
mov edx, dword [ebp - 0xb8]
call fcn.10043b30
mov byte [ebp - 4], 0
or ecx, 0xffffffff
mov edx, dword [ebp - 0xb8]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100d3e2b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x9c]
inc esi
mov edx, dword [ebp - 0xac]
add ecx, 4
add edx, 0x28
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0xac], edx
cmp esi, dword [ebp - 0xa8]
jl 0x100d3c33
mov eax, dword [ebp - 0x94]
test eax, eax
je 0x100d3e69
push eax
call fcn.10103713
add esp, 4
mov eax, dword [ebp - 0xb4]
test eax, eax
je 0x100d3e7c
push eax
call fcn.10103713
add esp, 4
push dword [ebp - 0xc4]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea eax, [ebp - 0xa8]
push str.LoadImageFromMemory:_out__success_
push eax
call fcn.10044f30
add esp, 8
mov byte [ebp - 4], 7
mov ecx, str.ImaginarySection
mov edx, dword [ebp - 0xa8]
call fcn.10043b30
mov byte [ebp - 4], 0
or ecx, 0xffffffff
mov edx, dword [ebp - 0xa8]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100d3ed4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x98]
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov edi, dword [ebp + 0x2c]
add edi, 0xfffffff0
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100d3efe
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10103392
mov esp, ebp
pop ebp
ret