Function at 0x10003f50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100096e0]
mov edx, dword [0x100096e4]
lea ecx, [eax*2 + 0x100096e8]
inc eax
mov dword [0x100096e4], ecx
push esi
mov dword [0x100096e0], eax
mov ax, word [edx]
push edi
push 0x2fd0
mov word [ecx], ax
call fcn.10005615
push 0x3fc
push 0
push eax
mov dword [0x100b93d8], eax
call sub.VCRUNTIME140.dll_memset
mov edi, dword [0x100b93d8]
lea eax, [ebp - 8]
inc dword [0x10009658]
add esp, 0x10
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add edi, 0x2c
mov dword [0x100b93dc], 0xff
push eax
push 0x40
push 4
push 0x4083c1
call esi
mov dword [0x4083c1], edi
test eax, eax
je 0x10003fed
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 4
push 0x4083c1
call esi
mov edi, dword [0x100b93d8]
lea eax, [ebp - 8]
inc dword [0x10009658]
add edi, 0x2ffc
push eax
push 0x40
push 4
push 0x4083de
call esi
mov dword [0x4083de], edi
test eax, eax
je 0x10004028
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 4
push 0x4083de
call esi
mov edi, dword [0x100b93d8]
lea eax, [ebp - 8]
inc dword [0x10009658]
add edi, 0x2c
push eax
push 0x40
push 4
push 0x40845b
call esi
mov dword [0x40845b], edi
test eax, eax
je 0x10004060
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 4
push 0x40845b
call esi
mov edi, dword [0x100b93d8]
lea eax, [ebp - 8]
inc dword [0x10009658]
add edi, 0x2c
push eax
push 0x40
push 4
push 0x4084a2
call esi
mov dword [0x4084a2], edi
test eax, eax
je 0x10004098
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 4
push 0x4084a2
call esi
mov edi, dword [0x100b93d8]
lea eax, [ebp - 8]
inc dword [0x10009658]
push eax
push 0x40
push 4
push 0x4083e9
call esi
mov dword [0x4083e9], edi
test eax, eax
je 0x100040cd
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 4
push 0x4083e9
call esi
mov edi, dword [0x100b93d8]
lea eax, [ebp - 8]
inc dword [0x10009658]
add edi, 0x2fd0
push eax
push 0x40
push 4
push 0x4083fa
call esi
mov dword [0x4083fa], edi
test eax, eax
je 0x10004108
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 4
push 0x4083fa
call esi
mov edi, dword [0x100b93d8]
lea eax, [ebp - 8]
inc dword [0x10009658]
push eax
push 0x40
push 4
push 0x40840b
call esi
mov dword [0x40840b], edi
test eax, eax
je 0x1000413d
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 4
push 0x40840b
call esi
mov edi, dword [0x100b93d8]
lea eax, [ebp - 8]
inc dword [0x10009658]
add edi, 0x2fd0
push eax
push 0x40
push 4
push 0x40841a
call esi
mov dword [0x40841a], edi
test eax, eax
je 0x10004178
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 4
push 0x40841a
call esi
mov edi, dword [0x100b93d8]
lea eax, [ebp - 8]
inc dword [0x10009658]
push eax
push 0x40
push 4
push 0x40843b
call esi
mov dword [0x40843b], edi
test eax, eax
je 0x100041ad
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 4
push 0x40843b
call esi
mov edi, dword [0x100b93d8]
lea eax, [ebp - 8]
inc dword [0x10009658]
push eax
push 0x40
push 4
push 0x408479
call esi
mov dword [0x408479], edi
test eax, eax
je 0x100041e2
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 4
push 0x408479
call esi
mov edi, dword [0x100b93d8]
lea eax, [ebp - 8]
inc dword [0x10009658]
push eax
push 0x40
push 4
push 0x5b82f1
call esi
mov dword [0x5b82f1], edi
test eax, eax
je 0x10004217
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 4
push 0x5b82f1
call esi
mov edi, dword [0x100b93d8]
lea eax, [ebp - 8]
inc dword [0x10009658]
push eax
push 0x40
push 4
push 0x5b82fd
call esi
mov dword [0x5b82fd], edi
test eax, eax
je 0x1000424c
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 4
push 0x5b82fd
call esi
mov edi, dword [0x100b93d8]
lea eax, [ebp - 8]
inc dword [0x10009658]
add edi, 0x2fd0
push eax
push 0x40
push 4
push 0x5b8303
call esi
mov dword [0x5b8303], edi
test eax, eax
je 0x10004287
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 4
push 0x5b8303
call esi
mov edi, dword [0x100b93d8]
lea eax, [ebp - 8]
inc dword [0x10009658]
push eax
push 0x40
push 4
push 0x1567b94
call esi
mov dword [0x1567b94], edi
test eax, eax
je 0x100042bc
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 4
push 0x1567b94
call esi
mov edi, dword [0x100b93d8]
lea eax, [ebp - 8]
inc dword [0x10009658]
add edi, 0x2fd0
push eax
push 0x40
push 4
push 0x1567ba2
call esi
mov dword [0x1567ba2], edi
test eax, eax
je 0x100042f7
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 4
push 0x1567ba2
call esi
mov edi, dword [0x100b93d8]
lea eax, [ebp - 8]
inc dword [0x10009658]
push eax
push 0x40
push 4
push 0x1567bba
call esi
mov dword [0x1567bba], edi
test eax, eax
je 0x1000432c
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 4
push 0x1567bba
call esi
mov edi, dword [0x100b93d8]
lea eax, [ebp - 8]
inc dword [0x10009658]
add edi, 0x2c
push eax
push 0x40
push 4
push 0x1567bd6
call esi
mov dword [0x1567bd6], edi
test eax, eax
je 0x10004364
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 4
push 0x1567bd6
call esi
mov edi, dword [0x100b93d8]
lea eax, [ebp - 8]
inc dword [0x10009658]
add edi, 0x28
push eax
push 0x40
push 4
push 0x1567be3
call esi
mov dword [0x1567be3], edi
test eax, eax
je 0x1000439c
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 4
push 0x1567be3
call esi
mov edi, dword [0x100b93d8]
lea eax, [ebp - 8]
inc dword [0x10009658]
add edi, 0x28
push eax
push 0x40
push 4
push 0x408461
call esi
mov dword [0x408461], edi
test eax, eax
je 0x100043d4
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 4
push 0x408461
call esi
mov edi, dword [0x100b93d8]
lea eax, [ebp - 8]
inc dword [0x10009658]
add edi, 0x28
push eax
push 0x40
push 4
push 0x4084a8
call esi
mov dword [0x4084a8], edi
test eax, eax
je 0x1000440c
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 4
push 0x4084a8
call esi
mov edi, dword [0x100b93d8]
lea eax, [ebp - 8]
inc dword [0x10009658]
add edi, 0x2c
push eax
push 0x40
push 4
push 0x40757f
call esi
mov dword [0x40757f], edi
test eax, eax
je 0x10004444
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 4
push 0x40757f
call esi
mov edi, dword [0x100b93d8]
lea eax, [ebp - 8]
inc dword [0x10009658]
add edi, 0x2c
push eax
push 0x40
push 4
push 0x408fdc
call esi
mov dword [0x408fdc], edi
test eax, eax
je 0x1000447c
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 4
push 0x408fdc
call esi
mov edi, dword [0x100b93d8]
lea eax, [ebp - 8]
inc dword [0x10009658]
add edi, 0x2c
push eax
push 0x40
push 4
push 0x409d5a
call esi
mov dword [0x409d5a], edi
test eax, eax
je 0x100044b4
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 4
push 0x409d5a
call esi
mov edi, dword [0x100b93d8]
lea eax, [ebp - 8]
inc dword [0x10009658]
add edi, 0x2c
push eax
push 0x40
push 4
push 0x40cc54
call esi
mov dword [0x40cc54], edi
test eax, eax
je 0x100044ec
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 4
push 0x40cc54
call esi
mov edi, dword [0x100b93d8]
lea eax, [ebp - 8]
inc dword [0x10009658]
add edi, 0x2c
push eax
push 0x40
push 4
push 0x40ccc7
call esi
mov dword [0x40ccc7], edi
test eax, eax
je 0x10004524
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 4
push 0x40ccc7
call esi
mov edi, dword [0x100b93d8]
lea eax, [ebp - 8]
inc dword [0x10009658]
add edi, 0x2c
push eax
push 0x40
push 4
push 0x1560e68
call esi
mov dword [0x1560e68], edi
test eax, eax
je 0x1000455c
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 4
push 0x1560e68
call esi
mov edi, dword [0x100b93d8]
lea eax, [ebp - 8]
inc dword [0x10009658]
add edi, 0x2c
push eax
push 0x40
push 4
push 0x15663e7
call esi
mov dword [0x15663e7], edi
test eax, eax
je 0x10004594
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 4
push 0x15663e7
call esi
mov eax, dword [0x100096e0]
dec eax
mov dword [0x100096e0], eax
pop edi
pop esi
test eax, eax
jle 0x100045c1
lea eax, [eax*2 + 0x100096e6]
mov dword [0x100096e4], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100055a1
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [0x100096e4], 0
call fcn.100055a1
mov esp, ebp
pop ebp
ret 4