Function at 0x10001340
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10014004]
xor eax, ebp
mov dword [ebp - 4], eax
sub dword [ebp + 0xc], 1
mov eax, dword [ebp + 8]
jne 0x10001584
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0x10015518
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x10012d14
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, eax
lea eax, [ebp - 8]
mov dword [0x10015620], esi
push eax
push 0x40
push 5
push esi
call ebx
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [0x10015628], eax
mov eax, section..text
sub eax, esi
mov dword [0x1001562c], ecx
sub eax, 5
mov byte [esi], 0xe9
mov dword [esi + 1], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 2
push 0x6c0420
mov word [ebp - 0x18], 0x6a
call ebx
movzx eax, word [ebp - 0x18]
mov word [0x6c0420], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 2
push 0x6c0420
call ebx
xorps xmm0, xmm0
mov dword [ebp - 0xc], 0
push str.samp.dll
movq qword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 8]
push eax
push 0x40
push 2
add esi, 0x7535c
mov word [ebp - 0x18], 0x16a
push esi
call ebx
movzx eax, word [ebp - 0x18]
mov word [esi], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 2
push esi
call ebx
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 8]
push eax
push 0x40
add esi, 0x60970
push 2
push esi
call ebx
lea eax, [ebp - 8]
mov dword [esi], 0xf7850f
push eax
mov word [esi + 4], 0
push dword [ebp - 8]
push 2
push esi
call ebx
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 8]
push eax
push 0x40
push 2
add esi, 0xe5dd
push esi
call ebx
lea eax, [ebp - 8]
mov dword [esi], 0x3e7f3d
push eax
mov byte [esi + 4], 0
push dword [ebp - 8]
push 2
push esi
call ebx
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 8]
push eax
push 0x40
push 2
add esi, 0xa58d0
push esi
call ebx
lea eax, [ebp - 8]
mov dword [esi], 0x3e80fa81
push eax
mov word [esi + 4], 0
push dword [ebp - 8]
push 2
push esi
call ebx
mov ecx, dword [ebp - 0x14]
lea eax, [ecx + 0xa58f5]
mov dword [0x10015514], eax
lea esi, [ecx + 0xa58d8]
lea eax, [ecx + 0xa58fe]
mov dword [0x10015510], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push esi
call ebx
mov eax, 0x10001210
mov byte [esi], 0xe9
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push esi
call ebx
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x6e0961
call ebx
mov eax, 0x10001250
mov byte [0x6e0961], 0xe9
sub eax, 0x6e0966
mov dword [0x6e0962], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push 0x6e0961
call ebx
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x68a50e
call ebx
mov eax, 0x100012e0
mov byte [0x68a50e], 0xe9
sub eax, 0x68a513
mov dword [0x68a50f], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push 0x68a50e
call ebx
pop esi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.10001599
mov esp, ebp
pop ebp
ret 0xc