Function at 0x10013320
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10047410]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
push str.engine.dll
call esi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0x100134d5
mov eax, 0x5a4d
cmp word [edi], ax
je 0x1001336e
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001f521
mov esp, ebp
pop ebp
ret
mov esi, dword [edi + 0x3c]
add esi, edi
cmp dword [esi], 0x4550
jne 0x10013356
mov edx, dword [esi + 0x104]
lea eax, [edx + edi - 0x1000]
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x10
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 0x108]
push eax
call fcn.1001f56a
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x108]
push eax
call fcn.1001f56a
add esp, 8
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov edx, dword [esi + 0x108]
push edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
push eax
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edi, dword [ebp - 0x10]
test eax, eax
je 0x100134bc
mov edx, dword [esi + 0x108]
mov eax, dword [ebp - 0x1c]
push edx
push eax
push edi
call fcn.10029240
mov esi, dword [ebp - 0x18]
add esp, 0xc
mov dword [ebp - 0xc], 0xc1f7
mov word [ebp - 8], 0xff00
mov word [ebp - 0x24], 0x2d39
xor ecx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x34], 0x1fd81
mov word [ebp - 0x30], bx
cmp ecx, esi
jae 0x100134bc
xor dl, dl
lea esp, [esp]
cmp dl, 6
jae 0x1001344f
movzx eax, dl
lea ebx, [eax + ecx]
mov bl, byte [ebx + edi]
cmp bl, byte [ebp + eax - 0xc]
jne 0x1001344a
inc dl
xor ebx, ebx
jmp 0x10013430
inc ecx
xor ebx, ebx
jmp 0x10013422
mov esi, ecx
sub ecx, 0xb4
cmp ecx, esi
jae 0x100134bc
xor dl, dl
lea ecx, [ecx]
cmp dl, 2
jae 0x1001347d
movzx eax, dl
lea ebx, [eax + ecx]
mov bl, byte [ebx + edi]
cmp bl, byte [ebp + eax - 0x24]
jne 0x10013478
inc dl
jmp 0x10013460
inc ecx
xor ebx, ebx
jmp 0x10013457
mov edx, dword [ebp - 0x2c]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x10]
push eax
push 0x40
lea esi, [ecx + edx]
push 6
push esi
call ebx
test eax, eax
je 0x100134bc
mov ecx, dword [ebp - 0x34]
mov dx, word [ebp - 0x30]
mov dword [esi], ecx
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x10]
push eax
push ecx
push 6
push esi
mov word [esi + 4], dx
call ebx
mov dword [0x10058ca4], 1
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.1001f530
mov eax, dword [ebp - 0x1c]
push eax
jmp 0x100137a3
push str.swds.dll
call esi
mov edi, eax
cmp edi, ebx
je 0x10013638
mov ecx, 0x5a4d
cmp word [edi], cx
jne 0x10013356
mov esi, dword [edi + 0x3c]
add esi, edi
cmp dword [esi], 0x4550
jne 0x10013356
mov eax, dword [esi + 0x104]
lea ecx, [eax + edi - 0x1000]
mov dword [ebp - 0x2c], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x10
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 0x108]
push eax
call fcn.1001f56a
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x108]
push eax
call fcn.1001f56a
mov ecx, dword [ebp - 0x10]
add esp, 8
lea edx, [ebp - 0x28]
push edx
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x28], ebx
mov eax, dword [esi + 0x108]
push eax
push ecx
push edi
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edi, dword [ebp - 0x18]
test eax, eax
je 0x1001361f
mov eax, dword [esi + 0x108]
mov ecx, dword [ebp - 0x10]
push eax
push ecx
push edi
call fcn.10029240
mov esi, dword [ebp - 0x28]
mov al, 0x90
add esp, 0xc
mov dword [ebp - 0xc], 0xe381
mov word [ebp - 8], 0xfff0
xor ecx, ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 0x9090c033
mov byte [ebp - 0x14], al
cmp ecx, esi
jae 0x1001361f
xor dl, dl
lea ecx, [ecx]
cmp dl, 6
jae 0x100135cd
movzx eax, dl
lea ebx, [eax + ecx]
mov bl, byte [ebx + edi]
cmp bl, byte [ebp + eax - 0xc]
jne 0x100135c8
inc dl
jmp 0x100135b0
inc ecx
xor ebx, ebx
jmp 0x100135a7
mov eax, ecx
sub ecx, 0xb4
cmp ecx, eax
jae 0x1001361f
cmp byte [ecx + edi], 0xa1
je 0x100135e2
inc ecx
jmp 0x100135d5
mov edx, dword [ebp - 0x2c]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x1c]
push eax
push 0x40
lea esi, [ecx + edx]
push 5
push esi
call ebx
test eax, eax
je 0x1001361f
mov ecx, dword [ebp - 0x18]
mov dl, byte [ebp - 0x14]
mov dword [esi], ecx
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x1c]
push eax
push ecx
push 5
push esi
mov byte [esi + 4], dl
call ebx
mov dword [0x10058ca4], 1
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.1001f530
mov eax, dword [ebp - 0x10]
push eax
jmp 0x100137a3
push str.hl.exe
call esi
mov esi, eax
cmp esi, ebx
je 0x100137ab
mov ecx, 0x5a4d
cmp word [esi], cx
je 0x1001366b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001f521
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x3c]
cmp dword [eax + esi], 0x4550
jne 0x10013653
mov eax, dword [eax + esi + 0x104]
lea ecx, [eax + esi - 0x1000]
mov dword [ebp - 0x2c], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x10
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x2000000
mov dword [ebp - 0x18], eax
call fcn.1001f56a
push 0x2000000
mov dword [ebp - 0x10], eax
call fcn.1001f56a
mov ecx, dword [ebp - 0x18]
add esp, 8
lea edx, [ebp - 0x28]
push edx
push 0x2000000
mov edi, eax
mov eax, dword [ebp - 0x10]
push eax
push esi
push ecx
mov dword [ebp - 0x28], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1001378f
mov edx, dword [ebp - 0x10]
push 0x2000000
push edx
push edi
call fcn.10029240
mov esi, dword [ebp - 0x28]
mov al, 0x90
add esp, 0xc
mov dword [ebp - 0xc], 0xe781
mov word [ebp - 8], 0xfff0
xor ecx, ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], 0x9090c033
mov byte [ebp - 0x20], al
mov edi, edi
cmp ecx, esi
jae 0x1001378f
xor dl, dl
lea ebx, [ebx]
cmp dl, 6
jae 0x1001373d
movzx eax, dl
lea ebx, [eax + ecx]
mov bl, byte [ebx + edi]
cmp bl, byte [ebp + eax - 0xc]
jne 0x10013738
inc dl
jmp 0x10013720
inc ecx
xor ebx, ebx
jmp 0x10013710
mov eax, ecx
sub ecx, 0xb4
cmp ecx, eax
jae 0x1001378f
cmp byte [ecx + edi], 0xa1
je 0x10013752
inc ecx
jmp 0x10013745
mov eax, dword [ebp - 0x2c]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esi, [ecx + eax]
lea ecx, [ebp - 0x1c]
push ecx
push 0x40
push 5
push esi
call ebx
test eax, eax
je 0x1001378f
mov edx, dword [ebp - 0x24]
mov al, byte [ebp - 0x20]
mov dword [esi], edx
mov edx, dword [ebp - 0x1c]
lea ecx, [ebp - 0x1c]
push ecx
push edx
push 5
push esi
mov byte [esi + 4], al
call ebx
mov dword [0x10058ca4], 1
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.1001f530
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.1001f530
add esp, 8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001f521
mov esp, ebp
pop ebp
ret