Function at 0x1001fc40
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x10]
push edi
push eax
push 0x40
push 5
push 0x4e976e
call esi
mov byte [0x4e976e], 0xe9
mov eax, 0x10020520
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 0xffb1688d
mov dword [0x4e976f], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push 5
push 0x4e976e
call esi
lea eax, [ebp - 0x10]
push eax
push 0x40
push 5
push 0x4e99fa
call esi
mov byte [0x4e99fa], 0xe9
mov eax, 0x10020540
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 0xffb16601
mov dword [0x4e99fb], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push 5
push 0x4e99fa
call esi
lea eax, [ebp - 0x10]
push eax
push 0x40
push 5
push 0x4e997f
call esi
mov byte [0x4e997f], 0xe9
mov eax, 0x100205a0
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 0xffb1667c
mov dword [0x4e9980], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push 5
push 0x4e997f
call esi
lea eax, [ebp - 0x10]
push eax
push 0x40
push 5
push 0x5dd860
call esi
mov byte [0x5dd860], 0xe9
mov eax, 0x10020680
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 0xffa2279b
mov dword [0x5dd861], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push 5
push 0x5dd860
call esi
lea eax, [ebp - 0x10]
push eax
push 0x40
push 5
push 0x5dd898
call esi
mov byte [0x5dd898], 0xe9
mov eax, 0x100206c0
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 0xffa22763
mov dword [0x5dd899], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push 5
push 0x5dd898
call esi
mov eax, dword [0x10056768]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push 4
push eax
push 0x4e9af8
call edi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call esi
mov eax, dword [0x10056768]
push 0
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push 4
push eax
push 0x4e9bac
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x10
push eax
push 0x4e3691
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x10
push eax
push 0x4e36a6
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x10
push eax
push 0x4e36ba
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x11
push eax
push 0x4df1ed
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x11
push eax
push 0x4e0fd0
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x11
push eax
push 0x4e20d1
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x11
push eax
push 0x4e2908
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x11
push eax
push 0x4e3785
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x11
push eax
push 0x4e92ad
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x11
push eax
push 0x4e95f4
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x11
push eax
push 0x4e95fc
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x11
push eax
push 0x4e9c76
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x11
push eax
push 0x4ea410
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x11
push eax
push 0x4ec3db
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x11
push eax
push 0x4e9a92
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x83
push eax
push 0x4e991b
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x83
push eax
push 0x4e9f0a
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x83
push eax
push 0x4ea018
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x83
push eax
push 0x4ea10b
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x83
push eax
push 0x4ea1d1
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x83
push eax
push 0x4ea34b
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x83
push eax
push 0x4ea3db
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x54
push eax
push 0x4e2846
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x54
push eax
push 0x4e2866
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x54
push eax
push 0x4e3839
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x5c
push eax
push 0x4e284d
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 8
push eax
push 0x4e9814
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x12
push eax
push 0x4e9815
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 8
push eax
push 0x4e9821
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x12
push eax
push 0x4e9822
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 4
push eax
push 0x4e9879
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x12
push eax
push 0x4e987a
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 4
push eax
push 0x4e9892
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x12
push eax
push 0x4e9893
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0
push eax
push 0x4e98fe
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x12
push eax
push 0x4e98ff
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0
push eax
push 0x4e990b
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x12
push eax
push 0x4e990c
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 8
push eax
push 0x4e9e1e
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x12
push eax
push 0x4e9e1f
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 8
push eax
push 0x4e9e2b
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x12
push eax
push 0x4e9e2c
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 8
push eax
push 0x4e4468
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x12
push eax
push 0x4e4469
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x10
push eax
push 0x4e3691
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x10
push eax
push 0x4e36a6
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x10
push eax
push 0x4e36ba
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x11
push eax
push 0x4df1ed
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x11
push eax
push 0x4e0fd0
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x11
push eax
push 0x4e20d1
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x11
push eax
push 0x4e2908
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x11
push eax
push 0x4e3785
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x11
push eax
push 0x4e92ad
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x11
push eax
push 0x4e95f4
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x11
push eax
push 0x4e95fc
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x11
push eax
push 0x4e9c76
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x11
push eax
push 0x4ea410
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x11
push eax
push 0x4ec3db
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x11
push eax
push 0x4e9a92
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x83
push eax
push 0x4e991b
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x83
push eax
push 0x4e9f0a
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x83
push eax
push 0x4ea018
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x83
push eax
push 0x4ea10b
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x83
push eax
push 0x4ea1d1
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x50
push eax
push 0x4e96bd
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x20
push eax
push 0x4e9a22
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x17
push eax
push 0x4e9a10
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x44
push eax
push 0x4e9730
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x1d
push eax
push 0x4e99ef
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x40
push eax
push 0x4e973c
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x1c
push eax
push 0x4e99e0
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x3c
push eax
push 0x4e96fc
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x21
push eax
push 0x4e99ce
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x38
push eax
push 0x4e9702
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x1b
push eax
push 0x4e99bf
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x34
push eax
push 0x4e9761
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x22
push eax
push 0x4e99ad
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x30
push eax
push 0x4e9736
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x1a
push eax
push 0x4e999b
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x2c
push eax
push 0x4e975b
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x28
push eax
push 0x4e96f3
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x1f
push eax
push 0x4e9974
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x24
push eax
push 0x4e972a
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x1e
push eax
push 0x4e995f
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x20
push eax
push 0x4e977b
call edi
push eax
call esi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x2b
push eax
push 0x4e994d
call edi
push eax
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret