Function at 0x1001c710
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [ebp + 8], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
je 0x1001cbef
push esi
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x100dd240], eax
lea eax, [ebp - 4]
push eax
push 1
lea eax, [ebp + 0xb]
mov byte [ebp + 0xb], 0xe9
push eax
push 0x4e36f2
call ebx
push eax
call edi
mov eax, 0x1001f5c0
sub eax, 0x4e36f7
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x4e36f3
call ebx
push eax
call edi
lea eax, [ebp - 8]
mov byte [ebp + 0xb], 0xe9
push eax
push 1
lea eax, [ebp + 0xb]
push eax
push 0x4c36d1
call ebx
push eax
call edi
mov eax, 0x1001ed20
sub eax, 0x4c36d6
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x4c36d2
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0xeb
push eax
push 0x4eb10b
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0xeb
push eax
push 0x4eb179
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0xeb
push eax
push 0x4eb1cb
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0xeb
push eax
push 0x4eb459
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0x43
push eax
push 0x4eb45a
call ebx
push eax
call edi
lea eax, [ebp - 8]
mov byte [ebp + 0xb], 0xe9
push eax
push 1
lea eax, [ebp + 0xb]
push eax
push 0x4c3225
call ebx
push eax
call edi
mov eax, 0x1001ee90
sub eax, 0x4c322a
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x4c3226
call ebx
push eax
call edi
lea eax, [ebp - 8]
mov byte [ebp + 0xb], 0xe9
push eax
push 1
lea eax, [ebp + 0xb]
push eax
push 0x4eb171
call ebx
push eax
call edi
mov eax, 0x1001edd0
sub eax, 0x4eb176
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x4eb172
call ebx
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push 0x4eb176
call esi
mov eax, 0x4eb176
mov byte [eax], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 1
push 0x4eb176
call esi
lea eax, [ebp - 8]
mov byte [ebp + 0xb], 0xe9
push eax
push 1
lea eax, [ebp + 0xb]
push eax
push 0x5b71a3
call ebx
push eax
call edi
mov eax, 0x1001f2e0
sub eax, 0x5b71a8
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x5b71a4
call ebx
push eax
call edi
lea eax, [ebp - 8]
mov byte [ebp + 0xb], 0xe9
push eax
push 1
lea eax, [ebp + 0xb]
push eax
push 0x4eb6c6
call ebx
push eax
call edi
mov eax, 0x1001ee00
sub eax, 0x4eb6cb
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x4eb6c7
call ebx
push eax
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push 0x4eb6cb
call esi
mov eax, 0x4eb6cb
mov byte [eax], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 1
push 0x4eb6cb
call esi
lea eax, [ebp - 8]
mov byte [ebp + 0xb], 0xe9
push eax
push 1
lea eax, [ebp + 0xb]
push eax
push 0x4eb6dc
call ebx
push eax
call edi
mov eax, 0x1001ee20
sub eax, 0x4eb6e1
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x4eb6dd
call ebx
push eax
call edi
lea eax, [ebp - 8]
mov byte [ebp + 0xb], 0xe9
push eax
push 1
lea eax, [ebp + 0xb]
push eax
push 0x4eb4d4
call ebx
push eax
call edi
mov eax, 0x1001ee70
sub eax, 0x4eb4d9
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x4eb4d5
call ebx
push eax
call edi
lea eax, [ebp - 8]
mov byte [ebp + 0xb], 0xe9
push eax
push 1
lea eax, [ebp + 0xb]
push eax
push 0x4e6b0e
call ebx
push eax
call edi
mov eax, 0x1001e620
sub eax, 0x4e6b13
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x4e6b0f
call ebx
push eax
call edi
lea eax, [ebp - 8]
mov byte [ebp + 0xb], 0xe9
push eax
push 1
lea eax, [ebp + 0xb]
push eax
push 0x5c0f2b
call ebx
push eax
call edi
mov eax, 0x1001e640
sub eax, 0x5c0f30
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x5c0f2c
call ebx
push eax
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 2
push 0x5c0f30
call esi
mov eax, 0x5c0f30
mov ecx, 0x90909090
mov word [eax], cx
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 2
push 0x5c0f30
call esi
lea eax, [ebp - 8]
mov byte [ebp + 0xb], 0xe9
push eax
push 1
lea eax, [ebp + 0xb]
push eax
push 0x4eb218
call ebx
push eax
call edi
mov eax, 0x1001e660
sub eax, 0x4eb21d
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x4eb219
call ebx
push eax
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push 0x4eb21d
call esi
mov eax, 0x4eb21d
mov byte [eax], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 1
push 0x4eb21d
call esi
lea eax, [ebp - 8]
mov byte [ebp + 0xb], 0xe9
push eax
push 1
lea eax, [ebp + 0xb]
push eax
push 0x4c167f
call ebx
push eax
call edi
mov eax, 0x1001e680
sub eax, 0x4c1684
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x4c1680
call ebx
push eax
call edi
lea eax, [ebp - 8]
mov byte [ebp + 0xb], 0xe9
push eax
push 1
lea eax, [ebp + 0xb]
push eax
push 0x4eb592
call ebx
push eax
call edi
mov eax, 0x1001e6b0
sub eax, 0x4eb597
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x4eb593
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0xeb
push eax
push 0x4eaf96
call ebx
push eax
call edi
lea eax, [ebp - 8]
mov byte [ebp + 0xb], 0xe9
push eax
push 1
lea eax, [ebp + 0xb]
push eax
push 0x4c3841
call ebx
push eax
call edi
mov eax, 0x1001f700
sub eax, 0x4c3846
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x4c3842
call ebx
push eax
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push 0x4c3846
call esi
mov eax, 0x4c3846
mov byte [eax], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 1
push 0x4c3846
call esi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0x3b
push eax
push 0x4e078e
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0x42
push eax
push 0x4e078f
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0xf
push eax
push 0x4e0790
call ebx
push eax
call edi
pop esi
push 0
push 1
lea eax, [ebp + 8]
mov dword [0x100dc29c], 1
push eax
push 0x4df6ba
mov byte [ebp + 8], 0x3e
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0x42
push eax
push 0x4df6bb
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0xf
push eax
push 0x4df6bc
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0x3d
push eax
push 0x4df5d3
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0x42
push eax
push 0x4df5d4
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0xf
push eax
push 0x4df5d5
call ebx
push eax
call edi
lea eax, [ebp - 8]
mov byte [ebp + 0xb], 0xe9
push eax
push 1
lea eax, [ebp + 0xb]
push eax
push 0x5bb8ec
call ebx
push eax
call edi
mov eax, 0x1001b170
sub eax, 0x5bb8f1
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x5bb8ed
call ebx
push eax
call edi
lea eax, [ebp - 8]
mov byte [ebp + 0xb], 0xe9
push eax
push 1
lea eax, [ebp + 0xb]
push eax
push 0x4b2d30
call ebx
push eax
call edi
mov eax, 0x1001b320
sub eax, 0x4b2d35
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x4b2d31
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 1
push eax
push 0x4ea89d
call ebx
push eax
call edi
lea eax, [ebp - 8]
mov byte [ebp + 0xb], 0xe9
push eax
push 1
lea eax, [ebp + 0xb]
push eax
push 0x4ea888
call ebx
push eax
call edi
mov eax, 0x1001e460
sub eax, 0x4ea88d
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x4ea889
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0x66
push eax
push 0x4ea8b0
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 2
push eax
push 0x4ea8ae
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 9
push eax
push 0x5bb9e5
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0x1f
push eax
push 0x5bb9ee
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 1
push eax
push 0x5bb9ef
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0xa8
push eax
push 0x5bb891
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0xff
push eax
push 0x5bb8b9
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0x56
push eax
push 0x5bb8e2
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0xa
push eax
push 0x5bb857
call ebx
push eax
call edi
lea eax, [ebp - 8]
mov byte [ebp + 0xb], 0xe9
push eax
push 1
lea eax, [ebp + 0xb]
push eax
push 0x5bb862
call ebx
push eax
call edi
mov eax, 0x1001fb30
sub eax, 0x5bb867
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x5bb863
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0xb4
push eax
push 0x5bb92f
call ebx
push eax
call edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret