Function at 0x10005110
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d0205
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x10105018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [0x10107f70]
mov eax, 0x2aaaaaab
sub ecx, dword [0x10107f68]
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x98
jae 0x1000516c
push ecx
mov ecx, 0x10107f68
call fcn.1000b340
cmp dword [0x101079ec], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
jne 0x10005187
push str.samp.dll
call esi
mov dword [0x101079ec], eax
cmp dword [0x101079d8], 1
mov edi, dword [0x101079ec]
jg 0x100051e0
test edi, edi
jne 0x100051a6
push str.samp.dll
call esi
mov dword [0x101079ec], eax
mov ecx, dword [0x101079ec]
test ecx, ecx
jne 0x100051b4
xor eax, eax
jmp 0x100051e5
mov eax, dword [ecx + 0x3c]
mov ecx, dword [eax + ecx + 0x28]
cmp ecx, 0xcc4d0
je 0x100051d6
xor eax, eax
cmp ecx, 0x31df13
sete al
inc eax
mov dword [0x101079d8], eax
jmp 0x100051e0
mov dword [0x101079d8], 3
mov eax, dword [0x101079d8]
add eax, 0xfffffffe
imul eax, eax, 0x5c
mov eax, dword [eax + 0x100f7d44]
add eax, edi
mov dword [0x10107c20], eax
mov eax, dword [0x10107c24]
mov dword [0x10107c24], 0
test eax, eax
je 0x10005214
push eax
call fcn.100a8aca
add esp, 4
mov edi, dword [0x10107c1c]
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x60], 0x100fc264
mov dword [ebp - 0x5c], 0x10007e50
mov dword [ebp - 0x3c], ecx
test edi, edi
je 0x10005259
mov eax, dword [edi]
cmp edi, 0x10107bf8
mov ecx, edi
mov edx, dword [eax + 0x10]
setne al
push eax
call edx
mov ecx, dword [ebp - 0x3c]
mov dword [0x10107c1c], 0
test ecx, ecx
je 0x100052ab
lea eax, [ebp - 0x60]
cmp ecx, eax
jne 0x1000528c
mov eax, dword [ecx]
push 0x10107bf8
call dword [eax + 4]
mov ecx, dword [ebp - 0x3c]
mov dword [0x10107c1c], eax
test ecx, ecx
je 0x100052ab
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
lea eax, [ebp - 0x60]
cmp ecx, eax
setne al
push eax
call edx
jmp 0x10005292
mov dword [0x10107c1c], ecx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
test ecx, ecx
je 0x100052ab
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
lea eax, [ebp - 0x60]
cmp ecx, eax
setne al
push eax
call edx
cmp byte [0x10107c4d], 0
mov edi, 1
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualQuery]
jne 0x1000533c
mov eax, dword [0x10107c20]
test eax, eax
je 0x1000533c
push 0x1c
lea ecx, [ebp - 0x30]
push ecx
push eax
call ebx
mov eax, dword [ebp - 0x1c]
cmp eax, 0x10
je 0x100052ea
cmp eax, 0x20
je 0x100052ea
cmp eax, 0x40
je 0x100052ea
cmp eax, 0x80
jne 0x1000533c
push ecx
mov ecx, dword [0x10107c20]
mov edx, 0x10107c34
call fcn.100046b0
add esp, 4
test al, al
je 0x1000533c
mov eax, dword [0x10107c34]
push dword [eax + 0x20]
push dword [eax + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
je 0x1000533c
push 1
mov ecx, 0x10107bf8
call fcn.1000c0e0
movzx ecx, byte [0x10107c4d]
test al, al
cmovne ecx, edi
mov byte [0x10107c4d], cl
cmp dword [0x101079ec], 0
jne 0x10005351
push str.samp.dll
call esi
mov dword [0x101079ec], eax
cmp dword [0x101079d8], 1
mov edi, dword [0x101079ec]
jg 0x100053aa
test edi, edi
jne 0x10005370
push str.samp.dll
call esi
mov dword [0x101079ec], eax
mov ecx, dword [0x101079ec]
test ecx, ecx
jne 0x1000537e
xor eax, eax
jmp 0x100053af
mov eax, dword [ecx + 0x3c]
mov ecx, dword [eax + ecx + 0x28]
cmp ecx, 0xcc4d0
je 0x100053a0
xor eax, eax
cmp ecx, 0x31df13
sete al
inc eax
mov dword [0x101079d8], eax
jmp 0x100053aa
mov dword [0x101079d8], 3
mov eax, dword [0x101079d8]
add eax, 0xfffffffe
imul eax, eax, 0x5c
push 0x10009f90
mov eax, dword [eax + 0x100f7d48]
add eax, edi
push eax
push 0x10107db0
call fcn.1000d880
cmp dword [0x101079ec], 0
jne 0x100053e2
push str.samp.dll
call esi
mov dword [0x101079ec], eax
cmp dword [0x101079d8], 1
mov edi, dword [0x101079ec]
jg 0x1000543b
test edi, edi
jne 0x10005401
push str.samp.dll
call esi
mov dword [0x101079ec], eax
mov ecx, dword [0x101079ec]
test ecx, ecx
jne 0x1000540f
xor eax, eax
jmp 0x10005440
mov eax, dword [ecx + 0x3c]
mov ecx, dword [eax + ecx + 0x28]
cmp ecx, 0xcc4d0
je 0x10005431
xor eax, eax
cmp ecx, 0x31df13
sete al
inc eax
mov dword [0x101079d8], eax
jmp 0x1000543b
mov dword [0x101079d8], 3
mov eax, dword [0x101079d8]
add eax, 0xfffffffe
imul eax, eax, 0x5c
mov eax, dword [eax + 0x100f7d58]
add eax, edi
mov dword [0x10107c78], eax
mov eax, dword [0x10107c7c]
mov dword [0x10107c7c], 0
test eax, eax
je 0x1000546f
push eax
call fcn.100a8aca
add esp, 4
mov edi, dword [0x10107c74]
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x88], 0x100fbfb4
mov dword [ebp - 0x84], 0x10008080
mov dword [ebp - 0x64], ecx
test edi, edi
je 0x100054bd
mov eax, dword [edi]
cmp edi, 0x10107c50
mov ecx, edi
mov edx, dword [eax + 0x10]
setne al
push eax
call edx
mov ecx, dword [ebp - 0x64]
mov dword [0x10107c74], 0
test ecx, ecx
je 0x10005518
lea eax, [ebp - 0x88]
cmp ecx, eax
jne 0x100054f6
mov eax, dword [ecx]
push 0x10107c50
call dword [eax + 4]
mov ecx, dword [ebp - 0x64]
mov dword [0x10107c74], eax
test ecx, ecx
je 0x10005518
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
lea eax, [ebp - 0x88]
cmp ecx, eax
setne al
push eax
call edx
jmp 0x100054fc
mov dword [0x10107c74], ecx
xor ecx, ecx
mov dword [ebp - 0x64], ecx
test ecx, ecx
je 0x10005518
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
lea eax, [ebp - 0x88]
cmp ecx, eax
setne al
push eax
call edx
cmp byte [0x10107ca5], 0
jne 0x100055a7
mov eax, dword [0x10107c78]
test eax, eax
je 0x100055a7
push 0x1c
lea ecx, [ebp - 0x30]
push ecx
push eax
call ebx
mov eax, dword [ebp - 0x1c]
cmp eax, 0x10
je 0x10005550
cmp eax, 0x20
je 0x10005550
cmp eax, 0x40
je 0x10005550
cmp eax, 0x80
jne 0x100055a7
push ecx
mov ecx, dword [0x10107c78]
mov edx, 0x10107c8c
call fcn.100046b0
add esp, 4
test al, al
je 0x100055a7
mov eax, dword [0x10107c8c]
push dword [eax + 0x20]
push dword [eax + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
je 0x100055a7
push 1
mov ecx, 0x10107c50
call fcn.1000be90
movzx ecx, byte [0x10107ca5]
test al, al
mov eax, 1
cmovne ecx, eax
mov byte [0x10107ca5], cl
cmp dword [0x101079ec], 0
jne 0x100055bc
push str.samp.dll
call esi
mov dword [0x101079ec], eax
cmp dword [0x101079d8], 1
mov edi, dword [0x101079ec]
jg 0x10005615
test edi, edi
jne 0x100055db
push str.samp.dll
call esi
mov dword [0x101079ec], eax
mov ecx, dword [0x101079ec]
test ecx, ecx
jne 0x100055e9
xor eax, eax
jmp 0x1000561a
mov eax, dword [ecx + 0x3c]
mov ecx, dword [eax + ecx + 0x28]
cmp ecx, 0xcc4d0
je 0x1000560b
xor eax, eax
cmp ecx, 0x31df13
sete al
inc eax
mov dword [0x101079d8], eax
jmp 0x10005615
mov dword [0x101079d8], 3
mov eax, dword [0x101079d8]
add eax, 0xfffffffe
imul eax, eax, 0x5c
push 0x10008e90
mov eax, dword [eax + 0x100f7d98]
add eax, edi
push eax
push 0x10107ca8
call fcn.1000d9c0
mov ecx, dword [0x101079ec]
test ecx, ecx
jne 0x10005651
push str.samp.dll
call esi
mov ecx, eax
mov dword [0x101079ec], ecx
mov eax, dword [0x101079d8]
mov edi, ecx
cmp eax, 1
jg 0x1000569f
test edi, edi
jne 0x10005670
push str.samp.dll
call esi
mov ecx, eax
mov dword [0x101079ec], ecx
test ecx, ecx
jne 0x10005678
xor eax, eax
jmp 0x1000569f
mov eax, dword [ecx + 0x3c]
mov ecx, dword [eax + ecx + 0x28]
cmp ecx, 0xcc4d0
je 0x10005695
xor eax, eax
cmp ecx, 0x31df13
sete al
inc eax
jmp 0x1000569a
mov eax, 3
mov dword [0x101079d8], eax
add eax, 0xfffffffe
imul eax, eax, 0x5c
push 0x10009b20
mov eax, dword [eax + 0x100f7d50]
add eax, edi
push eax
push 0x10107d58
call fcn.1000d9c0
cmp dword [0x101079ec], 0
jne 0x100056d2
push str.samp.dll
call esi
mov dword [0x101079ec], eax
cmp dword [0x101079d8], 1
mov edi, dword [0x101079ec]
jg 0x1000572b
test edi, edi
jne 0x100056f1
push str.samp.dll
call esi
mov dword [0x101079ec], eax
mov ecx, dword [0x101079ec]
test ecx, ecx
jne 0x100056ff
xor eax, eax
jmp 0x10005730
mov eax, dword [ecx + 0x3c]
mov ecx, dword [eax + ecx + 0x28]
cmp ecx, 0xcc4d0
je 0x10005721
xor eax, eax
cmp ecx, 0x31df13
sete al
inc eax
mov dword [0x101079d8], eax
jmp 0x1000572b
mov dword [0x101079d8], 3
mov eax, dword [0x101079d8]
add eax, 0xfffffffe
imul eax, eax, 0x5c
mov eax, dword [eax + 0x100f7d64]
add eax, edi
mov dword [0x10107e30], eax
mov eax, dword [0x10107e34]
mov dword [0x10107e34], 0
test eax, eax
je 0x1000575f
push eax
call fcn.100a8aca
add esp, 4
mov edi, dword [0x10107e2c]
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0xb0], 0x100fbe48
mov dword [ebp - 0xac], 0x10009fb0
mov dword [ebp - 0x8c], ecx
test edi, edi
je 0x100057b6
mov eax, dword [edi]
cmp edi, 0x10107e08
mov ecx, edi
mov edx, dword [eax + 0x10]
setne al
push eax
call edx
mov ecx, dword [ebp - 0x8c]
mov dword [0x10107e2c], 0
test ecx, ecx
je 0x10005817
lea eax, [ebp - 0xb0]
cmp ecx, eax
jne 0x100057f2
mov eax, dword [ecx]
push 0x10107e08
call dword [eax + 4]
mov ecx, dword [ebp - 0x8c]
mov dword [0x10107e2c], eax
test ecx, ecx
je 0x10005817
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
lea eax, [ebp - 0xb0]
cmp ecx, eax
setne al
push eax
call edx
jmp 0x100057f8
mov dword [0x10107e2c], ecx
xor ecx, ecx
mov dword [ebp - 0x8c], ecx
test ecx, ecx
je 0x10005817
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
lea eax, [ebp - 0xb0]
cmp ecx, eax
setne al
push eax
call edx
cmp byte [0x10107e5d], 0
jne 0x100058a6
mov eax, dword [0x10107e30]
test eax, eax
je 0x100058a6
push 0x1c
lea ecx, [ebp - 0x30]
push ecx
push eax
call ebx
mov eax, dword [ebp - 0x1c]
cmp eax, 0x10
je 0x1000584f
cmp eax, 0x20
je 0x1000584f
cmp eax, 0x40
je 0x1000584f
cmp eax, 0x80
jne 0x100058a6
push ecx
mov ecx, dword [0x10107e30]
mov edx, 0x10107e44
call fcn.100046b0
add esp, 4
test al, al
je 0x100058a6
mov eax, dword [0x10107e44]
push dword [eax + 0x20]
push dword [eax + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
je 0x100058a6
push 1
mov ecx, 0x10107e08
call fcn.1000b9f0
movzx ecx, byte [0x10107e5d]
test al, al
mov eax, 1
cmovne ecx, eax
mov byte [0x10107e5d], cl
cmp dword [0x101079ec], 0
jne 0x100058bb
push str.samp.dll
call esi
mov dword [0x101079ec], eax
cmp dword [0x101079d8], 1
mov edi, dword [0x101079ec]
jg 0x10005914
test edi, edi
jne 0x100058da
push str.samp.dll
call esi
mov dword [0x101079ec], eax
mov ecx, dword [0x101079ec]
test ecx, ecx
jne 0x100058e8
xor eax, eax
jmp 0x10005919
mov eax, dword [ecx + 0x3c]
mov ecx, dword [eax + ecx + 0x28]
cmp ecx, 0xcc4d0
je 0x1000590a
xor eax, eax
cmp ecx, 0x31df13
sete al
inc eax
mov dword [0x101079d8], eax
jmp 0x10005914
mov dword [0x101079d8], 3
mov eax, dword [0x101079d8]
add eax, 0xfffffffe
imul eax, eax, 0x5c
push 0x1000a020
mov eax, dword [eax + 0x100f7d68]
add eax, edi
push eax
push 0x10107e60
call fcn.1000d880
mov ecx, dword [0x101079ec]
test ecx, ecx
jne 0x10005950
push str.samp.dll
call esi
mov ecx, eax
mov dword [0x101079ec], ecx
mov eax, dword [0x101079d8]
mov edi, ecx
cmp eax, 1
jg 0x1000599e
test edi, edi
jne 0x1000596f
push str.samp.dll
call esi
mov ecx, eax
mov dword [0x101079ec], ecx
test ecx, ecx
jne 0x10005977
xor eax, eax
jmp 0x1000599e
mov eax, dword [ecx + 0x3c]
mov ecx, dword [eax + ecx + 0x28]
cmp ecx, 0xcc4d0
je 0x10005994
xor eax, eax
cmp ecx, 0x31df13
sete al
inc eax
jmp 0x10005999
mov eax, 3
mov dword [0x101079d8], eax
add eax, 0xfffffffe
imul eax, eax, 0x5c
push 0x1000a040
mov eax, dword [eax + 0x100f7d6c]
add eax, edi
push eax
push 0x10107eb8
call fcn.1000d880
mov ecx, dword [0x101079ec]
test ecx, ecx
jne 0x100059d5
push str.samp.dll
call esi
mov ecx, eax
mov dword [0x101079ec], ecx
mov eax, dword [0x101079d8]
mov edi, ecx
cmp eax, 1
jg 0x10005a23
test edi, edi
jne 0x100059f4
push str.samp.dll
call esi
mov ecx, eax
mov dword [0x101079ec], ecx
test ecx, ecx
jne 0x100059fc
xor eax, eax
jmp 0x10005a23
mov eax, dword [ecx + 0x3c]
mov ecx, dword [eax + ecx + 0x28]
cmp ecx, 0xcc4d0
je 0x10005a19
xor eax, eax
cmp ecx, 0x31df13
sete al
inc eax
jmp 0x10005a1e
mov eax, 3
mov dword [0x101079d8], eax
add eax, 0xfffffffe
imul eax, eax, 0x5c
push 0x1000a0b0
mov eax, dword [eax + 0x100f7d70]
add eax, edi
push eax
push 0x10107f10
call fcn.1000d880
mov ecx, dword [0x101079ec]
test ecx, ecx
jne 0x10005a5a
push str.samp.dll
call esi
mov ecx, eax
mov dword [0x101079ec], ecx
mov eax, dword [0x101079d8]
mov edi, ecx
cmp eax, 1
jg 0x10005aa8
test edi, edi
jne 0x10005a79
push str.samp.dll
call esi
mov ecx, eax
mov dword [0x101079ec], ecx
test ecx, ecx
jne 0x10005a81
xor eax, eax
jmp 0x10005aa8
mov eax, dword [ecx + 0x3c]
mov ecx, dword [eax + ecx + 0x28]
cmp ecx, 0xcc4d0
je 0x10005a9e
xor eax, eax
cmp ecx, 0x31df13
sete al
inc eax
jmp 0x10005aa3
mov eax, 3
mov dword [0x101079d8], eax
add eax, 0xfffffffe
imul eax, eax, 0x5c
push 0x10008eb0
mov eax, dword [eax + 0x100f7d94]
add eax, edi
push eax
push 0x10107d00
call fcn.1000d9c0
mov ebx, dword [0x101079d8]
mov ecx, dword [0x101079ec]
cmp ebx, 1
jg 0x10005b18
test ecx, ecx
jne 0x10005af2
push str.samp.dll
call esi
mov ecx, eax
mov dword [0x101079ec], ecx
test ecx, ecx
jne 0x10005af2
xor ebx, ebx
jmp 0x10005b18
mov eax, dword [ecx + 0x3c]
mov eax, dword [eax + ecx + 0x28]
cmp eax, 0xcc4d0
je 0x10005b0d
xor ebx, ebx
cmp eax, 0x31df13
sete bl
inc ebx
jmp 0x10005b12
mov ebx, 3
mov dword [0x101079d8], ebx
test ecx, ecx
jne 0x10005b2b
push str.samp.dll
call esi
mov ecx, eax
mov dword [0x101079ec], ecx
mov edi, dword [ebx*8 + 0x100f7d00]
lea eax, [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add edi, ecx
push eax
push 0x40
push dword [ebx*8 + 0x100f7d04]
push edi
call esi
push dword [ebx*8 + 0x100f7d04]
push 0x90
push edi
call fcn.100aaf70
add esp, 0xc
push 0
push dword [ebp - 0x14]
push dword [ebx*8 + 0x100f7d04]
push edi
call esi
push 4
call fcn.100a8eb1
mov dword [ebp - 0x14], eax
mov dword [eax], 0x10107b90
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x10010000
push 0
push 0
call fcn.100ae2ec
add esp, 0x1c
mov dword [ebp - 0x38], eax
test eax, eax
je 0x10005be9
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x34]
test ecx, ecx
je 0x10005bdc
push ecx
push eax
call fcn.100a8308
add esp, 8
test eax, eax
jne 0x10005be3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100a8abc
mov esp, ebp
pop ebp
ret
push 1
call fcn.100a78ee
push eax
call fcn.100a78c1
push 6
mov dword [ebp - 0x34], 0
call fcn.100a78ee
int3