Function at 0x1000aa20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.NxCharacter.2.8.1.dll
call esi
add eax, 0xcd0d
push str.NxCharacter.2.8.1.dll
mov dword [0x1001848c], eax
call esi
add eax, 0xcde0
lea ecx, [eax + 6]
mov dword [0x100198e4], ecx
mov ecx, dword [0x1001848c]
lea edx, [ecx + 6]
mov dword [0x10017248], eax
mov dword [0x1001a168], edx
test ecx, ecx
je 0x1000ad01
test eax, eax
je 0x1000ad01
mov esi, dword [0x1001a180]
mov ecx, dword [esi + 0x10]
cmp dword [ecx], 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
jbe 0x1000aaf2
lea edx, [ebp - 4]
push edx
push 0x40
push 6
push eax
mov esi, eax
call edi
mov edx, dword [ebp - 4]
lea ecx, [ebp - 8]
push ecx
mov eax, 0x1000a9f0
push edx
sub eax, esi
sub eax, 5
push 6
mov byte [esi], 0xe9
mov dword [esi + 1], eax
push esi
mov byte [esi + 5], 0x90
call edi
mov esi, dword [0x1001848c]
lea eax, [ebp - 4]
push eax
push 0x40
push 6
push esi
call edi
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
mov ecx, 0x1000a9d0
push eax
sub ecx, esi
sub ecx, 5
push 6
mov byte [esi], 0xe9
mov dword [esi + 1], ecx
push esi
mov byte [esi + 5], 0x90
call edi
mov esi, dword [0x1001a180]
cmp dword [0x1001a258], 1
jne 0x1000acac
push str.SPACE____Untuk_Menaikan_Badan_nCTRL____Untuk_Menurunkan_Badan
push 0xffffff00
push 0xf0
mov ecx, 0x140
call fcn.10007610
add esp, 0xc
push 0x20
mov dword [0x10018338], 0x10001490
call fcn.10001490
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
movsx ecx, ax
shr ecx, 0x10
test ecx, ecx
je 0x1000ab70
cmp byte [0x10018dd8], 0
je 0x1000ab5b
cmp dword [0x10018ddc], 0
je 0x1000ab77
call esi
mov edx, dword [0x10018ddc]
inc edx
cmp edx, eax
ja 0x1000ab77
mov byte [0x10018dd8], 1
call esi
mov dword [0x10018ddc], eax
mov eax, 1
jmp 0x1000ab79
mov byte [0x10018dd8], 0
xor eax, eax
test al, 1
je 0x1000ab8e
mov eax, 0x10018384
fld qword [eax - 4]
fadd qword [0x10012960]
fstp qword [eax - 4]
push 0x11
mov dword [0x10018338], 0x10001490
call fcn.10001490
cwde
shr eax, 0x10
test eax, eax
je 0x1000abdb
cmp byte [0x10018d60], 0
je 0x1000abc6
cmp dword [0x10018d64], 0
je 0x1000abe2
call esi
mov ecx, dword [0x10018d64]
inc ecx
cmp ecx, eax
ja 0x1000abe2
mov byte [0x10018d60], 1
call esi
mov dword [0x10018d64], eax
mov eax, 1
jmp 0x1000abe4
mov byte [0x10018d60], 0
xor eax, eax
test al, 1
je 0x1000abf9
mov eax, 0x10018384
fld qword [eax - 4]
fsub qword [0x10012960]
fstp qword [eax - 4]
cmp dword [0x1001a258], 0
jne 0x1000ac12
mov edx, 0x100194d8
fld qword [edx - 4]
mov eax, 0x10018384
fstp qword [eax - 4]
mov esi, dword [0x1001a180]
mov ecx, dword [esi + 0x10]
cmp dword [ecx], 0
jbe 0x1000ac6e
mov edx, dword [esi + 8]
mov eax, dword [edx]
mov ecx, dword [esi + 0x34]
mov eax, dword [eax + ecx]
push eax
call fcn.100048c0
add esp, 4
cmp eax, 2
jne 0x1000ac6e
cmp dword [0x10018384], 0
mov eax, 0x100194d8
fld qword [eax - 4]
mov ecx, 0x10018384
fstp qword [0x10018330]
fld qword [ecx - 4]
fstp qword [0x10017b50]
jne 0x1000ac64
fld qword [eax - 4]
fstp qword [ecx - 4]
mov dword [0x1001a258], 1
mov edx, dword [esi + 0x10]
cmp dword [edx], 0
jbe 0x1000ac8f
mov eax, dword [esi + 8]
mov ecx, dword [eax]
mov edx, dword [esi + 0x34]
mov eax, dword [ecx + edx]
push eax
call fcn.100048c0
add esp, 4
cmp eax, 3
jne 0x1000acac
cmp dword [0x10018384], 0
je 0x1000aca2
mov dword [0x10018384], 0
mov dword [0x100198dc], 1
cmp dword [0x1001a2b8], 0
lea eax, [ebp - 4]
push eax
push 0x40
push 1
je 0x1000acd9
mov dword [0x1001a258], 1
mov esi, dword [esi + 0xe4]
push esi
call edi
push 1
push 0x10012534
jmp 0x1000ace9
mov esi, dword [esi + 0xe4]
push esi
call edi
push 1
push 0x10012538
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 8]
push ecx
push edx
push 1
push esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret