Function at 0x10004280
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100290c0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x10042154], 0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
jne 0x10004355
cmp dword [0x10042654], 0
jne 0x10004355
mov eax, dword [0x11dd6788]
push 0x5c
mov ebx, dword [eax]
call fcn.10021050
add esp, 4
mov edi, eax
lea eax, [ebp - 0x10]
push eax
push 0x40
push 0x5c
push edi
call esi
push 0x5c
push ebx
push edi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov dword [0x10042654], edi
test ebx, ebx
je 0x10004310
lea eax, [ebp - 8]
push eax
push 0x40
push 0x5c
push edi
call esi
push 0x5c
push ebx
push edi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0x5c
push edi
call esi
mov edi, dword [0x10042654]
mov ebx, dword [0x11dd6788]
test ebx, ebx
je 0x1000433d
test edi, edi
je 0x1000433d
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push ebx
call esi
lea eax, [ebp - 0xc]
mov dword [ebx], edi
push eax
push dword [ebp - 8]
push 4
push ebx
call esi
mov edi, dword [0x10042654]
push edi
push str.MemoryFakeImportCB_:__p_n
call fcn.10002080
add esp, 8
mov dword [0x10042154], 1
mov edi, dword [0x10042654]
add edi, 0x40
je 0x1000437d
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 0xc]
mov dword [edi], fcn.100040e0
push eax
push dword [ebp - 8]
push 4
push edi
call esi
mov edi, dword [0x10042654]
add edi, 0x44
je 0x100043a5
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 0xc]
mov dword [edi], fcn.100040e0
push eax
push dword [ebp - 8]
push 4
push edi
call esi
mov edi, dword [0x10042654]
add edi, 0x48
je 0x100043cd
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 0xc]
mov dword [edi], fcn.100040e0
push eax
push dword [ebp - 8]
push 4
push edi
call esi
mov edi, dword [0x10042654]
add edi, 0x4c
je 0x100043f5
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 0xc]
mov dword [edi], fcn.100040e0
push eax
push dword [ebp - 8]
push 4
push edi
call esi
mov edi, dword [0x10042654]
add edi, 0x50
je 0x1000441d
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 0xc]
mov dword [edi], fcn.100040e0
push eax
push dword [ebp - 8]
push 4
push edi
call esi
mov edi, dword [0x10042654]
add edi, 0x54
je 0x10004445
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 0xc]
mov dword [edi], fcn.100040e0
push eax
push dword [ebp - 8]
push 4
push edi
call esi
mov edi, dword [0x10042654]
add edi, 0x58
je 0x1000446d
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 0xc]
mov dword [edi], fcn.100040e0
push eax
push dword [ebp - 8]
push 4
push edi
call esi
cmp dword [0x11dd696c], 0
jne 0x100044c1
mov edi, dword [0x10041fe8]
test edi, edi
je 0x100044b9
push 0xc
call fcn.10021050
add esp, 4
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0xc
push ebx
call esi
mov ecx, dword [edi]
mov dword [ebx], ecx
mov ax, word [edi + 4]
mov word [ebx + 4], ax
mov al, byte [edi + 6]
mov byte [ebx + 6], al
lea eax, [ebx + 7]
sub edi, eax
mov byte [eax], 0xe9
add edi, 2
mov dword [eax + 1], edi
jmp 0x100044bb
xor ebx, ebx
mov dword [0x11dd696c], ebx
cmp dword [0x11dd6aa0], 0
jne 0x100044fe
mov edi, dword [0x10042654]
add edi, 0x38
je 0x100044f6
mov ebx, dword [edi]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 0xc]
mov dword [edi], 0x10004210
push eax
push dword [ebp - 8]
push 4
push edi
call esi
jmp 0x100044f8
xor ebx, ebx
mov dword [0x11dd6aa0], ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10020ae5
mov esp, ebp
pop ebp
ret