Function at 0x10015e40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp byte [0x1009a37c], 0
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
je 0x10015ea6
push 0x5700f0
lea ecx, [ebp - 4]
call fcn.1000d340
mov esi, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push esi
mov dword [ebp - 0x10], 5
mov dword [ebp - 0x14], esi
call edi
test eax, eax
setne byte [ebp - 8]
mov dword [esi], 0x90909090
mov byte [esi + 4], 0x90
cmp byte [ebp - 8], 0
je 0x10015ea6
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call edi
cmp byte [0x1009a37d], 0
mov ebx, 0x90909090
je 0x10015f46
push 0x44cb56
lea ecx, [ebp - 4]
call fcn.1000d340
mov esi, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 2
push esi
mov dword [ebp - 0x10], 2
mov dword [ebp - 0x14], esi
call edi
test eax, eax
setne byte [ebp - 8]
mov word [esi], bx
cmp byte [ebp - 8], 0
je 0x10015eff
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call edi
push 0x44cbab
lea ecx, [ebp - 4]
call fcn.1000d340
mov esi, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 2
push esi
mov dword [ebp - 0x10], 2
mov dword [ebp - 0x14], esi
call edi
test eax, eax
setne byte [ebp - 8]
mov word [esi], bx
cmp byte [ebp - 8], 0
je 0x10015f46
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call edi
cmp byte [0x1009a394], 0
je 0x10015fe7
push 0x44b306
lea ecx, [ebp - 4]
call fcn.1000d340
mov esi, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], esi
call edi
test eax, eax
setne byte [ebp - 8]
mov dword [esi], 0xc3
cmp byte [ebp - 8], 0
je 0x10015f9d
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call edi
push 0x44ac9c
lea ecx, [ebp - 4]
call fcn.1000d340
mov esi, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], esi
call edi
test eax, eax
setne byte [ebp - 8]
mov dword [esi], 0xc3
cmp byte [ebp - 8], 0
je 0x10015fe7
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call edi
cmp byte [0x1009a395], 0
je 0x10016082
push 0x442e26
lea ecx, [ebp - 4]
call fcn.1000d340
mov esi, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 2
push esi
mov dword [ebp - 0x10], 2
mov dword [ebp - 0x14], esi
call edi
test eax, eax
setne byte [ebp - 8]
mov word [esi], bx
cmp byte [ebp - 8], 0
je 0x1001603b
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call edi
push 0x4431df
lea ecx, [ebp - 4]
call fcn.1000d340
mov esi, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 2
push esi
mov dword [ebp - 0x10], 2
mov dword [ebp - 0x14], esi
call edi
test eax, eax
setne byte [ebp - 8]
mov word [esi], bx
cmp byte [ebp - 8], 0
je 0x10016082
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call edi
cmp byte [0x1009a39a], 0
je 0x100160d2
push 0x561c90
lea ecx, [ebp - 4]
call fcn.1000d340
mov esi, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push esi
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], esi
call edi
test eax, eax
setne byte [ebp - 8]
mov byte [esi], 0xc3
cmp byte [ebp - 8], 0
je 0x100160d2
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call edi
cmp byte [0x1009a39b], 0
je 0x10016122
push 0x441770
lea ecx, [ebp - 4]
call fcn.1000d340
mov esi, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push esi
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], esi
call edi
test eax, eax
setne byte [ebp - 8]
mov byte [esi], 0xc3
cmp byte [ebp - 8], 0
je 0x10016122
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret