Function at 0x100044b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1002b0c0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x10044210], 0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
jne 0x10004585
cmp dword [0x100448f0], 0
jne 0x10004585
mov eax, dword [0x11dd8b3c]
push 0x5c
mov ebx, dword [eax]
call fcn.10022f7d
add esp, 4
mov edi, eax
lea eax, [ebp - 0x10]
push eax
push 0x40
push 0x5c
push edi
call esi
push 0x5c
push ebx
push edi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov dword [0x100448f0], edi
test ebx, ebx
je 0x10004540
lea eax, [ebp - 8]
push eax
push 0x40
push 0x5c
push edi
call esi
push 0x5c
push ebx
push edi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0x5c
push edi
call esi
mov edi, dword [0x100448f0]
mov ebx, dword [0x11dd8b3c]
test ebx, ebx
je 0x1000456d
test edi, edi
je 0x1000456d
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push ebx
call esi
lea eax, [ebp - 0xc]
mov dword [ebx], edi
push eax
push dword [ebp - 8]
push 4
push ebx
call esi
mov edi, dword [0x100448f0]
push edi
push str.MemoryFakeImportCB_:__p_n
call fcn.10002050
add esp, 8
mov dword [0x10044210], 1
mov edi, dword [0x100448f0]
add edi, 0x40
je 0x100045ad
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 0xc]
mov dword [edi], fcn.100042f0
push eax
push dword [ebp - 8]
push 4
push edi
call esi
mov edi, dword [0x100448f0]
add edi, 0x44
je 0x100045d5
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 0xc]
mov dword [edi], fcn.100042f0
push eax
push dword [ebp - 8]
push 4
push edi
call esi
mov edi, dword [0x100448f0]
add edi, 0x48
je 0x100045fd
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 0xc]
mov dword [edi], fcn.100042f0
push eax
push dword [ebp - 8]
push 4
push edi
call esi
mov edi, dword [0x100448f0]
add edi, 0x4c
je 0x10004625
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 0xc]
mov dword [edi], fcn.100042f0
push eax
push dword [ebp - 8]
push 4
push edi
call esi
mov edi, dword [0x100448f0]
add edi, 0x50
je 0x1000464d
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 0xc]
mov dword [edi], fcn.100042f0
push eax
push dword [ebp - 8]
push 4
push edi
call esi
mov edi, dword [0x100448f0]
add edi, 0x54
je 0x10004675
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 0xc]
mov dword [edi], fcn.100042f0
push eax
push dword [ebp - 8]
push 4
push edi
call esi
mov edi, dword [0x100448f0]
add edi, 0x58
je 0x1000469d
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 0xc]
mov dword [edi], fcn.100042f0
push eax
push dword [ebp - 8]
push 4
push edi
call esi
cmp dword [0x11dd8d54], 0
jne 0x100046f1
mov edi, dword [0x1004403c]
test edi, edi
je 0x100046e9
push 0xc
call fcn.10022f7d
add esp, 4
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0xc
push ebx
call esi
mov ecx, dword [edi]
mov dword [ebx], ecx
mov ax, word [edi + 4]
mov word [ebx + 4], ax
mov al, byte [edi + 6]
mov byte [ebx + 6], al
lea eax, [ebx + 7]
sub edi, eax
mov byte [eax], 0xe9
add edi, 2
mov dword [eax + 1], edi
jmp 0x100046eb
xor ebx, ebx
mov dword [0x11dd8d54], ebx
cmp dword [0x11dd8ecc], 0
jne 0x1000472e
mov edi, dword [0x100448f0]
add edi, 0x38
je 0x10004726
mov ebx, dword [edi]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 0xc]
mov dword [edi], 0x10004440
push eax
push dword [ebp - 8]
push 4
push edi
call esi
jmp 0x10004728
xor ebx, ebx
mov dword [0x11dd8ecc], ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10022a15
mov esp, ebp
pop ebp
ret