Function at 0x10003410
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1000900c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10009674]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100096a8]
cmp eax, dword [ecx + 4]
jle 0x10003473
push 0x100096a8
call fcn.10004c03
add esp, 4
cmp dword [0x100096a8], 0xffffffff
jne 0x10003473
push 0x10005cb0
mov dword [0x100096ac], 0x100066a8
call fcn.10004f6c
push 0x100096a8
call fcn.10004bb2
add esp, 8
movq xmm0, qword [0x10006708]
mov ecx, 0x5ce7dc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 8], 0
movq qword [ecx], xmm0
movzx eax, byte [0x10006710]
mov byte [ecx + 8], al
mov ecx, 0x5be9a4
movq xmm0, qword [str.]
movq qword [ecx], xmm0
mov eax, dword [0x1000671c]
mov dword [ecx + 8], eax
movzx eax, byte [0x10006720]
mov byte [ecx + 0xc], al
mov ecx, 0x5be9d0
movq xmm0, qword [str.]
movq qword [ecx], xmm0
mov eax, dword [0x1000671c]
mov dword [ecx + 8], eax
movzx eax, byte [0x10006720]
mov byte [ecx + 0xc], al
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x55a0a9
call esi
test eax, eax
je 0x1000350c
lea eax, [ebp - 8]
mov byte [0x55a0a9], 0xeb
push eax
push dword [ebp - 8]
push 1
push 0x55a0a9
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 1
push 0x55a1d5
call esi
test eax, eax
je 0x1000353d
lea eax, [ebp - 8]
mov byte [0x55a1d5], 0xeb
push eax
push dword [ebp - 8]
push 1
push 0x55a1d5
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 1
push 0x559fc1
call esi
test eax, eax
je 0x1000356e
lea eax, [ebp - 8]
mov byte [0x559fc1], 0xeb
push eax
push dword [ebp - 8]
push 1
push 0x559fc1
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x42979b
call esi
test eax, eax
je 0x100035a2
lea eax, [ebp - 8]
mov dword [0x42979b], 0
push eax
push dword [ebp - 8]
push 4
push 0x42979b
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x465a4d
call esi
test eax, eax
je 0x100035d6
lea eax, [ebp - 8]
mov dword [0x465a4d], 0
push eax
push dword [ebp - 8]
push 4
push 0x465a4d
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x56678c
call esi
test eax, eax
je 0x1000360a
lea eax, [ebp - 8]
mov dword [0x56678c], 0
push eax
push dword [ebp - 8]
push 4
push 0x56678c
call esi
push ebx
push edi
push 0x10006200
push 9
mov dword [ebp - 8], 0
call fcn.10004fb5
mov edi, dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
add esp, 8
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x1000369d
mov ecx, 0x10003c60
mov byte [eax], 0xe9
sub ecx, 0x41f610
mov dword [eax + 1], ecx
mov dword [eax + 5], 0x90909090
lea eax, [ebp - 8]
push eax
push 0x40
push 9
push 0x41f60b
call esi
test eax, eax
je 0x1000369d
mov eax, dword [ebp - 0xc]
mov ecx, 0x41f60b
movq xmm0, qword [eax]
movq qword [ecx], xmm0
mov al, byte [eax + 8]
mov byte [ecx + 8], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 9
push ecx
call esi
test eax, eax
je 0x1000369d
push 9
push 0x41f60b
call ebx
push eax
call edi
push dword [ebp - 0xc]
call fcn.10004fb0
add esp, 4
push 0x10006200
push 7
mov dword [ebp - 8], 0
call fcn.10004fb5
add esp, 8
mov dword [ebp - 0xc], eax
test eax, eax
je 0x10003728
mov ecx, 0x10003b60
mov byte [eax], 0xe9
sub ecx, 0x423c5e
mov dword [eax + 1], ecx
mov ecx, 0x90909090
mov word [eax + 5], cx
lea eax, [ebp - 8]
push eax
push 0x40
push 7
push 0x423c59
call esi
test eax, eax
je 0x10003728
mov ecx, dword [ebp - 0xc]
mov edx, 0x423c59
mov eax, dword [ecx]
mov dword [edx], eax
mov ax, word [ecx + 4]
mov word [edx + 4], ax
mov al, byte [ecx + 6]
mov byte [edx + 6], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 7
push edx
call esi
test eax, eax
je 0x10003728
push 7
push 0x423c59
call ebx
push eax
call edi
push dword [ebp - 0xc]
call fcn.10004fb0
add esp, 4
push 0x10006200
push 0xa
mov dword [ebp - 8], 0
call fcn.10004fb5
add esp, 8
mov dword [ebp - 0xc], eax
test eax, eax
je 0x100037b3
mov byte [eax], 0xe9
mov ecx, 0x10003b90
sub ecx, 0x4222fa
mov dword [eax + 1], ecx
mov dword [eax + 5], 0x90909090
mov byte [eax + 9], 0x90
lea eax, [ebp - 8]
push eax
push 0x40
push 0xa
push 0x4222f5
call esi
test eax, eax
je 0x100037b3
mov eax, dword [ebp - 0xc]
mov ecx, 0x4222f5
movq xmm0, qword [eax]
movq qword [ecx], xmm0
mov ax, word [eax + 8]
mov word [ecx + 8], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0xa
push ecx
call esi
test eax, eax
je 0x100037b3
push 0xa
push 0x4222f5
call ebx
push eax
call edi
push dword [ebp - 0xc]
call fcn.10004fb0
add esp, 4
push 0x10006200
push 6
mov dword [ebp - 8], 0
call fcn.10004fb5
add esp, 8
mov dword [ebp - 0xc], eax
test eax, eax
je 0x10003833
mov ecx, 0x10003b30
mov byte [eax], 0xe9
sub ecx, 0x41ff8b
mov dword [eax + 1], ecx
mov byte [eax + 5], 0x90
lea eax, [ebp - 8]
push eax
push 0x40
push 6
push 0x41ff86
call esi
test eax, eax
je 0x10003833
mov ecx, dword [ebp - 0xc]
mov edx, 0x41ff86
mov eax, dword [ecx]
mov dword [edx], eax
mov ax, word [ecx + 4]
mov word [edx + 4], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push edx
call esi
test eax, eax
je 0x10003833
push 6
push 0x41ff86
call ebx
push eax
call edi
push dword [ebp - 0xc]
call fcn.10004fb0
add esp, 4
push 0x10006200
push 6
mov dword [ebp - 8], 0
call fcn.10004fb5
add esp, 8
mov dword [ebp - 0xc], eax
test eax, eax
je 0x100038b1
mov ecx, 0x10003b10
mov word [eax], 0x8d0f
sub ecx, 0x426dcf
mov dword [eax + 2], ecx
lea eax, [ebp - 8]
push eax
push 0x40
push 6
push 0x426dc9
call esi
test eax, eax
je 0x100038b1
mov ecx, dword [ebp - 0xc]
mov edx, 0x426dc9
mov eax, dword [ecx]
mov dword [edx], eax
mov ax, word [ecx + 4]
mov word [edx + 4], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push edx
call esi
test eax, eax
je 0x100038b1
push 6
push 0x426dc9
call ebx
push eax
call edi
push dword [ebp - 0xc]
call fcn.10004fb0
add esp, 4
push 0x10006200
push 5
mov dword [ebp - 8], 0
call fcn.10004fb5
add esp, 8
mov dword [ebp - 0xc], eax
test eax, eax
je 0x1000392b
mov ecx, 0x10003ae0
mov byte [eax], 0xe9
sub ecx, 0x427212
mov dword [eax + 1], ecx
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x42720d
call esi
test eax, eax
je 0x1000392b
mov ecx, dword [ebp - 0xc]
mov edx, 0x42720d
mov eax, dword [ecx]
mov dword [edx], eax
mov al, byte [ecx + 4]
mov byte [edx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push edx
call esi
test eax, eax
je 0x1000392b
push 5
push 0x42720d
call ebx
push eax
call edi
push dword [ebp - 0xc]
call fcn.10004fb0
add esp, 4
push 0x10006200
push 0xd
mov dword [ebp - 8], 0
call fcn.10004fb5
add esp, 8
mov dword [ebp - 0xc], eax
test eax, eax
je 0x100039bd
mov byte [eax], 0xe9
mov ecx, 0x10003f00
sub ecx, 0x4afd0d
mov dword [eax + 1], ecx
mov dword [eax + 5], 0x90909090
mov dword [eax + 9], 0x90909090
lea eax, [ebp - 8]
push eax
push 0x40
push 0xd
push 0x4afd08
call esi
test eax, eax
je 0x100039bd
mov ecx, dword [ebp - 0xc]
mov edx, 0x4afd08
movq xmm0, qword [ecx]
movq qword [edx], xmm0
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov al, byte [ecx + 0xc]
mov byte [edx + 0xc], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0xd
push edx
call esi
test eax, eax
je 0x100039bd
push 0xd
push 0x4afd08
call ebx
push eax
call edi
push dword [ebp - 0xc]
call fcn.10004fb0
add esp, 4
push 0x10006200
push 5
mov dword [ebp - 8], 0
call fcn.10004fb5
add esp, 8
mov dword [ebp - 0xc], eax
test eax, eax
je 0x10003a37
mov ecx, 0x10003f10
mov byte [eax], 0xe9
sub ecx, 0x465ac0
mov dword [eax + 1], ecx
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x465abb
call esi
test eax, eax
je 0x10003a37
mov ecx, dword [ebp - 0xc]
mov edx, 0x465abb
mov eax, dword [ecx]
mov dword [edx], eax
mov al, byte [ecx + 4]
mov byte [edx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push edx
call esi
test eax, eax
je 0x10003a37
push 5
push 0x465abb
call ebx
push eax
call edi
push dword [ebp - 0xc]
call fcn.10004fb0
add esp, 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 1
push 0x4a908d
call esi
pop edi
pop ebx
test eax, eax
je 0x10003a6a
lea eax, [ebp - 8]
mov byte [0x4a908d], 0x90
push eax
push dword [ebp - 8]
push 1
push 0x4a908d
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 1
push 0x4a908e
call esi
test eax, eax
je 0x10003a9b
lea eax, [ebp - 8]
mov byte [0x4a908e], 0x90
push eax
push dword [ebp - 8]
push 1
push 0x4a908e
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 1
push 0x4a908f
call esi
test eax, eax
je 0x10003acc
lea eax, [ebp - 8]
mov byte [0x4a908f], 0x90
push eax
push dword [ebp - 8]
push 1
push 0x4a908f
call esi
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.10004b43
mov esp, ebp
pop ebp
ret